You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
Gateway LoginArea: what it touches
ImprovementsKind: in v2.1.301,
ImprovementsSection of the release
Unclear It is not known where the allowlist comes from, or whether it holds any entries in this version.
What
When you log in through a gateway (a server that sits between Claude Code and the model service), Claude Code checks that the connection can be trusted. If that check fails and the login is for the "administrator" role, Claude Code now tries a customer allowlist before it gives up.
To do this it opens a secure (TLS) connection and compares these details against the allowlist:
The host name
The network range that the remote address belongs to
Optionally, a pinned root certificate, meaning one specific certificate authority that is trusted
If an entry matches, the login goes ahead and is recorded as allowlisted. When a root certificate is pinned, the connection check trusts only that one root.
Why
Companies whose gateways run on private networks, or use their own certificate authority, can get past the trust check this way instead of failing it.
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtIt is not known where the allowlist comes from, or whether it holds any entries in this version.
