v152 · Security · Fetch

Allowlist Violation Demo

Simulate how Connection Allowlists block or allow outbound requests. Configure two scenarios — a tight allowlist and an open allowlist — and fire requests to see which ones pass and which are blocked at the browser boundary.

Active policy (simulated)

Connection-Allowlist: "https://api.example.com", "https://cdn.example.com"

Fire requests

Allowlisted endpoints

These match the current policy — requests should pass.

  • ✓ https://api.example.com/data
  • ✓ https://cdn.example.com/bundle.js
—

Blocked endpoints

These don't appear in the allowlist — requests are blocked.

  • ✗ https://tracker.evil.io/pixel
  • ✗ https://exfil.attacker.net/data
  • ✗ https://analytics.thirdparty.com/collect
—

Request log

Ready. Fire requests above to see allowlist enforcement.

Header syntax

// HTTP response header — controls all fetches from this document
Connection-Allowlist: "https://api.example.com", "https://cdn.example.com"

// Wildcard — allows any HTTPS origin (less restrictive)
Connection-Allowlist: "https://*"

// Requests to unlisted endpoints are blocked (NetworkError)
// even if a script tries to fetch() or XHR them directly

references