Bjørn Erik Pedersen 62cef3678b security: Allow hostnames starting with digits in default http.urls ...

Domains like 1password.com and 37signals.com were blocked by the default
allow rule '^https?://[a-z]'. Allow [a-z0-9] for the first hostname char
and add an explicit deny for hosts whose first label is all-digit (IP
literals like 127.0.0.1) to retain the prior SSRF protections.

Fixes #14837

2026-05-01 15:34:20 +02:00

..

securityConfig_test.go

security: Allow hostnames starting with digits in default http.urls

2026-05-01 15:34:20 +02:00

securityConfig.go

security: Allow hostnames starting with digits in default http.urls

2026-05-01 15:34:20 +02:00

whitelist_test.go

config/security: Add "! " negation to Whitelist, harden default http.urls

2026-04-22 20:15:19 +02:00

whitelist.go

config/security: Add "! " negation to Whitelist, harden default http.urls

2026-04-22 20:15:19 +02:00