Allowlist
A list of explicitly permitted values, patterns, destinations or types; anything not on it is rejected. It fails closed when attackers find a new variant, which a denylist of known-bad inputs does not.
- Also called
- allow list
- Defined in
- NIST glossary: allowlist
Covered in
Validate input safely and prevent regex denial of service
Find and fix exponential and quadratic regex backtracking with measured examples, choose linear-time engines or timeouts, and build allowlist validation that decodes once and rejects type confusion and parameter pollution.
Constrain server-side fetches to their intended destinations
Prevent untrusted URLs from turning a preview, import, or webhook feature into access to internal services.
Defend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
Secure the developer workstation: extensions, package managers, secrets and AI agents
Attackers reach the software supply chain through developers' editors, package installs and AI agents. Allow-list extensions, stop install scripts and brand-new versions, keep long-lived secrets off laptops, and lock down repository files that run code when a project opens.
Authorize functions and fields as well as objects
Prevent mass assignment, sensitive-field exposure and administrative actions that a valid object lookup alone cannot protect.
Configure HTTP security headers from a tested baseline
Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.
All 18 pages that cover Allowlist in the library
Practice: SSRF lab: Guard an outbound fetch against SSRF · CSP builder lab: Build a strict Content-Security-Policy · JWT verification lab: Verify a JWT before trusting it · SSRF validation lab: Validate a fetch URL with ipaddress