A team secures the public admin entry and later finds an internal or legacy hostname still exposes it without the same edge restrictions.
An edge allowlist looks correct but an alternate hostname still exposes the admin surface because it bypasses the main proxy chain
The primary route is protected, yet a secondary hostname reaches the same backend through a path that never applies the allowlist.
Scenario
What to check first
- Identify the primary failure signal in the WAF / AppSec scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Inventory every hostname and proxy path that reaches the protected surface.
Questions worth viewing together
Community-field security problem inspired by Reddit and Server Fault posts where alternate hostnames bypassed edge allowlists. An allowlist protects only the paths that actually traverse it.
Teams often blame stale DNS or caching when the real issue is a second hostname bypassing the edge policy entirely.
Legacy hostnames frequently outlive newer edge security assumptions.
Similar cases seen in the field