Proxy setup

Some content blockers stop requests to hosts other than the site you are on. If identifications fail on part of your traffic and your own logs show the request never left the browser, you can send it through a path on your own domain instead. The script tag itself still loads from our script host.

With a session token, each identification sends one request to our API. When our bot checks ask for a challenge, the script answers it in the page and sends the answer in a second request:

Forward every path under /collect/ to https://api.lrdefender.lightningresearch.ai unchanged: method, body and headers. The session is bound to your page's origin, so the Origin and Authorization headers must reach us as the browser sent them.

On the server that already serves your site, one location block forwards the collection path. Other platforms are on Proxy integrations.

# In the server block for app.example.comlocation /collect/ {    proxy_pass https://api.lrdefender.lightningresearch.ai;    proxy_set_header Host api.lrdefender.lightningresearch.ai;    proxy_ssl_server_name on;    proxy_http_version 1.1;}

Pass your proxy's origin as endpoint. The SDK builds its request address from the origin alone, so the proxy must answer /collect/ at the root of its host: the same host as your site, or a subdomain of your own such as collect.example.com.

const lr = new LightningResearchSDK.LightningResearch({  sessionToken,  endpoint: "https://app.example.com", // your proxy: it must answer /collect/ at its root});const { requestId } = await lr.identify();

1. Open a page that runs the check, with your browser's developer tools on the network tab.
2. The collection request goes to your own host at /collect/device and answers 200 with a requestId.
3. Fetch the verdict for that request ID on your server, as in step 4 of the quick start.

Unless you name one, the SDK makes no other request to your page's own origin: apart from the script itself and the timing check's WebSocket, which goes straight to our edge service (see Content-Security-Policy), every request it sends goes to the endpoint you configured. A font list, task configuration or engine script you name with fontListUrl, taskConfigUrl or workerScriptUrl is fetched from the address you give, not through the endpoint, so the proxy does not need to forward it. Nor does it forward the task capture file: with task capture on, the script fetches it from our script host, where it sits beside the script, or from the base you name with tasksScriptBase if you serve the SDK's files yourself (see Requests to your own origin).

A 401 with the error Invalid collector session token means the session was refused: it expired, it ran out of uses, it was minted for another origin, or the Origin header did not reach us as the browser sent it.