Is there some whitelist to config?

if not, someone can use same subdomain/region to build a site to do something bad, such as trigger the delete mutation.

You should use permissions for that: https://docs.nhost.io/graphql/permissions

this is hasrua role base permissions right？ can it define rules which request come from！

> this is hasrua role base permissions right？
Yes

> can it define rules which request come from！
If you mean setting CORS domains we don't support this yet. Feel free to create an issue on GitHub so we can track it there

thanks i will try it

but i think nhost can support some env to define urls which application used.

something rules like Access-Control-Allow-Origin

Yes, see my previous answer about CORS

i will creat feature requset later

how to prevent others use same subdomain,region key to build another website?

https://firebase.google.com/docs/app-check

Google Firebase support this way, it looks like more complex.