{"version":"2.1.238","anchor":"loopback-jwks-overrides-now-require-an-explicit-test-escape-","canonical_anchor":"loopback-jwks-overrides-now-require-an-explicit-test-escape-","heading":"Loopback JWKS overrides now require an explicit test escape hatch","tier":"use","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/loopback-jwks-overrides-now-require-an-explicit-test-escape-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Loopback JWKS overrides now require an explicit test escape hatch\n\nPointing the gateway key-set URL at loopback is now blocked unless you set CLAUDE_GATEWAY_ALLOW_LOOPBACK, which is for tests only.\n\n**What**\n\nPointing the gateway's key-set URL at loopback is now rejected unless `CLAUDE_GATEWAY_ALLOW_LOOPBACK` is set, because the safe-fetch layer would block every such fetch at runtime anyway. The variable is absent by default and the surrounding errors say it exists for tests and must never be set in production.\n\n**Evidence**\n\n`cri.jwks_url targets loopback but CLAUDE_GATEWAY_ALLOW_LOOPBACK is not set \u2014 safeFetch would block every JWKS fetch at runtime. Set the escape (tests) or remove the override.`\n\n- Area: Auth\n- Names: `CLAUDE_GATEWAY_ALLOW_LOOPBACK`\n- Tier: Use it now\n- Useful: 2\/5\n- Signal: 3\/5"}