Affects
Teams that configure IP allowlists for Platform services behind a reverse proxy, load balancer, or CDN.
What changed
IP allowlists determine the client address from
X-Forwarded-For only when the direct peer is in the configured trusted-proxy CIDRs. A non-empty allowlist is enforced only for a selected console or api scope; a list with neither scope is inert. A resolved client IP that is not allowed is denied with HTTP 403. A missing or unusable client IP is also denied, unless the request’s transport peer is in PLATFORM_INTERNAL_CIDRS. If no allowlist is configured, the middleware allows the request.
This is a documentation correction of existing enforcement behavior; it does not announce a runtime release.
Impact
Classification: Action required. A missing or incorrect trusted-proxy CIDR can cause legitimate traffic to be denied or make forwarded client IPs untrustworthy.
What you need to do
1
Configure only the CIDRs of proxies that directly connect to the service as trusted proxies.
2
Test allowed and denied requests through the production proxy chain before enabling an allowlist.
3
Do not trust
X-Forwarded-For from direct clients or from an untrusted proxy.