the allowlist that starts empty

One server process serves several scopes: the public storefront, the marketplace, the authentication pages, the staff tools. Each had a host check — the request must arrive addressed to exactly the host this deployment serves. Strict, single-valued, and correct in production, and unworkable in development, where the same binary is reached through a laptop name, a container name, an address, and occasionally a loopback alias.

The temptation is a development bypass: if not in production, accept anything. That is how a debugging convenience becomes a production hole, because the flag selecting that branch is configuration, and configuration drifts. What shipped instead was an allowlist consulted only in development mode and defaulting to empty. In development, without an explicit entry, even the loopback address is refused. Production ignores the allowlist entirely: it does not merge with it, does not widen for it. The list is parsed with normalization — ports stripped from the host header, bracketed literals handled — and every scope runs the same matching path rather than four slightly different copies.

Four tests hold the line: an allowlisted host succeeds, an empty list stays strict even in development, production ignores the list, and the parser normalizes what it is given.

The cost is real and worth naming. A developer who clones the repository and runs it locally gets a rejection until they add their own host to a variable. That friction is the design. The alternative — convenient defaults plus an operator trusted to tighten them later — moves the work to the moment when nobody is looking.

What it proves: the default posture is denial, and the convenience path is the one that has to be asked for, explicitly, per host.