{"version":"2.1.260","anchor":"loopbacknon-https-url-rejection-widened-to-array-valued-boo","canonical_anchor":"loopbacknon-https-url-rejection-widened-to-array-valued-boo","heading":"Loopback\/non-https URL rejection widened to array-valued bootstrap fields","tier":"use","area":"Bootstrap Config","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260\/e\/loopbacknon-https-url-rejection-widened-to-array-valued-boo","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260","markdown":"### Loopback\/non-https URL rejection widened to array-valued bootstrap fields\n\nURL safety checks now cover list-valued config fields, with a new setting to allow loopback response URLs.\n\nThe loopback\/https hygiene check for bootstrap config, previously limited to single string URLs, now also inspects array-valued fields using a new helper that collects URLs from strings, arrays, and `{url}` objects. A new `allowLoopbackResponseUrls` setting can explicitly permit response URLs to point at loopback hosts.\n\n- Area: Bootstrap Config\n- Names: `allowLoopbackResponseUrls`\n- Tier: Use it now\n- Useful: 2\/5\n- Signal: 1\/5"}