{"version":"2.1.265","anchor":"crigateway-loopback-config-validator-gains-an-escape-hatch","canonical_anchor":"crigateway-loopback-config-validator-gains-an-escape-hatch","heading":"CRI\/gateway loopback config validator gains an escape-hatch env var","tier":"internal","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.265\/e\/crigateway-loopback-config-validator-gains-an-escape-hatch","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.265","markdown":"### CRI\/gateway loopback config validator gains an escape-hatch env var\n\nGateway loopback check now also covers cri.issuer and cri.policy.webhook.url, not just cri.jwks_url\n\n**What**\n\nThe deployment-time check that rejects loopback addresses (like `localhost`) in gateway configuration still requires the `CLAUDE_GATEWAY_ALLOW_LOOPBACK` environment variable to be set before it will allow one through. This check now also applies to `cri.issuer` and `cri.policy.webhook.url`, in addition to `cri.jwks_url`.\n\n**Why**\n\nThis widens the same safety net that was already in place for `cri.jwks_url` to two more configuration fields, so pointing any of these three settings at a loopback address without the escape-hatch variable set will still be treated as a fatal misconfiguration.\n\n- Area: Elsewhere\n- Names: `CLAUDE_GATEWAY_ALLOW_LOOPBACK`\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 1\/5"}