Function getHttpDenyList

packages/components/src/httpSecurity.ts:35–49

* Gets the HTTP deny list. * When HTTP_SECURITY_CHECK=false, the default deny list is omitted and only * HTTP_DENY_LIST entries are used. Defaults to true (secure). * @returns Array of denied IP addresses, hostnames, or CIDR ranges

()

 * @returns Array of denied IP addresses, hostnames, or CIDR ranges
 */
function getHttpDenyList(): string[] {
    const securityCheckEnabled = process.env.HTTP_SECURITY_CHECK !== 'false'
    const httpDenyListString = process.env.HTTP_DENY_LIST
    const customList = httpDenyListString
        ? httpDenyListString
              .split(',')
              .map((s) => s.trim())
              .filter(Boolean)
        : []

    if (securityCheckEnabled) {
        return [...new Set([...DEFAULT_DENY_LIST, ...customList])]
    }
    return customList
}

/**
 * Checks if an IP address is in the deny list