A team secures the public admin entry and later discovers that an internal or legacy hostname still exposes the same backend without the same edge restrictions.
An edge allowlist seems correct but an alternate hostname still bypasses it through another proxy chain
The main route is protected, yet the same backend remains reachable through a secondary hostname that never traverses the allowlisted edge path.
Scenario
What to check first
- Identify the primary failure signal in the WAF / AppSec scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Inventory every hostname and proxy chain that can reach the protected surface.
Questions worth viewing together
Community-field security problem inspired by Reddit and Server Fault discussions where alternate hostnames bypassed edge allowlists. An allowlist protects only the request paths that actually pass through it.
Teams often blame caching or DNS propagation when the real issue is a second hostname bypassing the protected edge path.
Legacy hostnames frequently outlive newer proxy and security assumptions.
Similar cases seen in the field