JP Site Search - Security Model
Article Index
- JP Site Search
- What is JP Site Search?
- What is Typesense?
- Typesense Hosting Options
- Recommended Typesense Server Setup
- Quick Docker Example
- Installation
- Initial Setup
- Sources and Providers
- Joomla Articles
- Joomla Contacts
- Joomla Categories
- DOCman Provider Add-on
- Indexing
- CLI and Cron
- Frontend Module
- Autocomplete Layouts
- Full Search Page
- Analytics and Search Quality
- Diagnostics
- Security Model
- Troubleshooting
- Recommended First Setup
- All Pages
Page 21 of 23
Security Model
JP Site Search is designed so that frontend visitors never communicate directly with Typesense.
Correct flow:
Browser
→ Joomla endpoint
→ server-side Typesense request
→ normalized safe result response
JP Site Search should never expose the following to public visitors:
- Typesense API keys
- Raw Typesense payloads
- Raw filter expressions
- Collection names
- Access metadata
- Administrator URLs
- Private file paths
- Unsafe external URLs
Sources and provider plugins must return safe normalized documents. JP Site Search handles public search through Joomla and applies runtime gating for enabled and disabled sources.
