Jamie Tanna 432bb00cd2 fix(workers/global): enforce allowedHeaders for the admin's own hostRules ...

For some time, admin configuration for `hostRules[].headers` was
enforced through `allowedHeaders`, but no validation feedback was given
to administrators, as it was silently ignored when `applyHostRule` runs.

To provide visibility to administrators who were setting headers that
were silently being ignored, we can instead provide validation at the
time we set our global host rules.

In a future change, we'll align the behaviour of `allowedHeaders` and
`allowedEnv` to make it so admin-controlled `hostRules` aren't bound by
the `allowedHeaders` flag.

We can also make it clear in the documentation that this is the
behaviour.

Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>

2026-09-03 08:01:41 +01:00

..

development

fix: remove references to "bot" (#39305)

2026-09-02 08:56:20 +00:00

usage

fix(workers/global): enforce allowedHeaders for the admin's own hostRules

2026-09-03 08:01:41 +01:00