How to ensure that only allowed domains can call C# from Javascript

Question

I noticed some samples flying around using [PermissionSet(SecurityAction.Demand, Name="FullTrust")] on classes used for webBrowser1.ObjectForScripting. Why is this used and not LinkDemand?

Also to put another layer of security, how can I ensure that only pages from allowed domains can execute code in the scripting object?

Answer 1

You can read the documentation to learn the differences between Demand and LinkDemand:
SecurityAction Enumeration

Here is a Microsoft support article with sample code that allows you to get the url of the web page hosting the ActiveX Control:
How To Retrieve the URL of a Web Page from an ActiveX Control