Configuring the Allowlist

Confluence administrators can choose to allow incoming and outgoing connections and content from specified sources for use in the:

by adding URLs to the allowlist. 

Confluence will display an error if content has been added that is not from an allowed source, and prompt the user to add the URL to the allowlist.

Application links are automatically added to the allowlist. You don't need to manually add them. 

Add allowed URLs to the allowlist

To add a URL to the allowlist:

  1. Go to Administration  > General Configuration > Allowlist
  2. Enter the URL or expression you want to allow.
  3. Choose the Type of expression (see below for examples of the types available).
  4. Choose Allow Incoming if you need to allow CORS requests (see below).
  5. Choose Allow anonymous users if you need to allow unauthenticated users.

  6. Choose Add

Your URL or expression appears in the allowlist.

To test that your allowlisted URL is working as expected you can enter a URL in the Test a URL field. Icons will indicate whether incoming and / or outgoing traffic is allowed for that URL. 

Expression types

When adding a URL to the allowlist, you can choose from a number of expression types. 

When deciding the best expression type to use, aim for a more restrictive URL, rather than less restrictive, to best protect your site.

Domain nameAllows all URLs from the specified domain.
Exact matchAllows only the specified URL.
Wildcard ExpressionAllows all matching URLs. Use the wildcard * character to replace one or more characters.https://*
Regular ExpressionAllows all URLs matching the regular expression.http(s)?://www\.example\.com

Allow Incoming

Allow Incoming enables CORS requests from the specified origin. The URL must match the format scheme://host[:port], with no trailing slashes (:port is optional). So would not allow CORS requests from the domain

Allow anonymous users

You can use the Allow anonymous users option to allow outbound requests on behalf of unauthenticated users. 

This isn't recommended for URLs that may contain private data, such as URLs from application links. If you do need to provide anonymous access, consider using an exact URL or wildcard based rule to limit access to just the required resources.

When you create an application link, the URL is automatically added to the Confluence allowlist. By default, outbound requests from these URLs is only allowed for authenticated users.

To change the default behaviour for all application links, including new application links:

  1. Go to Administration  > General Configuration > Allowlist
  2. Select Configure Settings.
  3. Select either:
    • Allow all users to allow outbound requests for all users, including anonymous users
    • Allow authenticated users to deny outbound requests for anonymous users
    • Restrict by default to deny outbound requests for all users (the applink will not be added to the allowlist at all)
  4. Save your changes.

All existing application links, and any new application links added to the allowlist, will use this setting. 

Disable the allowlist

The allowlist is enabled by default. You can choose to disable the allowlist however this will allow all URLs, including malicious content.

We strongly discourage you from disabling the allowlist, as it will leave you vulnerable to Server-Side Request Forgery (SSRF) attacks, such as the one disclosed in CONFSERVER-61399 - Getting issue details... STATUS

To disable the allowlist:

  1. Go to Administration  > General Configuration > Allowlist.
  2. Choose Turn off allowlist.
  3. Choose Confirm

All URLs will now be allowed. This is not recommended.

Last modified on May 25, 2023

Was this helpful?

Provide feedback about this article
Powered by Confluence and Scroll Viewport.