Security Enhancements / Claude Code v0.2.40

WebFetch tool now requires URLs to be "provided directly by the user in the current or a previous message"
Added URL extraction from user messages to maintain a whitelist of allowed URLs
Prevents potential security issues from arbitrary URL fetching

New environment variable ANTHROPIC_CUSTOM_HEADERS for adding custom headers to API requests
Supports multi-line header definitions with name: value format
Useful for proxy authentication or custom API configurations

The build it came inv0.2.40

13 Mar 2025 · 6 entries, this one is #2.

Either side of it

Open the release →

Names in this entry

toolWebFetch
Live-edit would be blocked on workshop pages so changes go through the validating publish path.
envANTHROPIC_CUSTOM_HEADERS
Custom headers to add to requests (Name: Value format, newline-separated for multiple headers). If a name or value contains a character an HTTP header can't carry, such as a curly quote or a zero-width space, the request fails with an error that identifies the pair by position. Requires Claude Code v2.1.227 or later. Invalid request header value lists the exact character set and where the check runs. A value that sets a credential, org or tenant, routing, or API-behavior header, such as Authorization or Host, counts as a setting that needs approval when server-managed settings deliver it. From project or local settings, such a value follows the rules for when env values apply

Is this right?