Home / Knowledge hub / Allowlist
Knowledge hub
Allowlist
A list of what you permit, with everything else refused by default.
What it means
An allowlist names what you permit and refuses everything else. A blocklist does the reverse: it names what you want to stop and lets the rest through.
That difference decides who has the harder job. A blocklist asks you to predict every bad input in advance, and nobody can. An allowlist asks only what your own application needs, which you already know.
Why it matters
Expensive input bugs usually trace back to a filter somebody wrote to catch what they had already seen. Attackers work on the shapes nobody thought of. An allowlist swaps the question 'is this dangerous?' for 'is this one of the things we accept?', and only the second has a reliable answer.
It pays a second way. An allowlist writes down what your application expects. That catches honest mistakes as well as attacks. A rename that broke a caller. A client sending a field it should not. An integration passing the wrong type.
How it shows up
Use one wherever your application takes something from outside and acts on it. File types on an upload. Sort fields in a query string. Redirect targets after login. The hosts a server may fetch from. The fields an API accepts in an update.
The common failure is an allowlist that gets checked and then ignored, such as code that validates a filename and then opens the raw value anyway.
Two more things weaken one in practice. A list so broad that it permits nearly everything is a blocklist wearing a better name. A list nobody maintains gets routed around the first time it refuses a legitimate case.
Questions people ask
Allowlist, answered
Is an IP blocklist a good way to stop attacks on a website?
On its own, no. A blocklist stops the addresses you already know about, and an attacker changes address for pennies. You will spend more time maintaining the list than anybody spends evading it.
CWE-184 exists precisely because incomplete lists of banned inputs keep failing in the same way.
Is an IP allowlist enough to protect a server?
It is better than a blocklist and still not enough by itself. An address says where a request appears to come from, not who sent it or what they may do.
Pair it with a real login and a real permission check. Then the allowlist is a useful extra layer instead of the only one.
Can an upload still be exploited if I allowlist the file types?
Yes, if the list checks the wrong thing. Trusting the extension or the content type the browser sent is not an allowlist of file types. It is an allowlist of claims about file types.
Check what the file actually is, store it outside the web root, and give it a name you generated. OWASP's input validation guidance covers uploads specifically.
Is it safe to allowlist a whole CDN domain?
Only if you trust everything that can ever be hosted there. A content network serves many customers, so allowing the domain means allowing whatever any of them publishes.
Name the exact paths instead, or pin the file you expect by its hash. The breadth of the entry is the size of the trust.
How do I convince a colleague to use an allowlist here?
Show them the refused case rather than the argument. Write down the values your feature genuinely accepts, then send it something outside the list and watch what the code does.
That usually lands faster than a principle, because the list of accepted values is short and the list of bad inputs never ends.
Related
Terms that sit next to this one
Input validation
Checking that what arrives is the shape and range you expected.
Untrusted input
Anything that arrived from outside your own code, and is therefore suspect.
Open redirect
A page that forwards visitors to any address handed to it in the URL.
SSRF
Making your server fetch a URL of the attacker's choosing.
Mass assignment
When the fields in a request get written straight onto a record.
Blocking bad input, or allowing good?
We send the shapes a blocklist never anticipated at your uploads, redirects, sort fields and server side fetches, then report only what actually got through. Tell us where your input arrives.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.