Skip to content
astro-doctor
Securitywarn by defaultrecommended presetastro-doctor/no-open-allowed-domains

no-open-allowed-domains

Configure explicit trusted host patterns instead of allowing every domain.

Why

An empty allowed-domain pattern matches every host and defeats the protection that security.allowedDomains is intended to provide. List the exact hostnames or constrained wildcard patterns that should be trusted.

Examples

Incorrect

Every domain is allowed

typescript
export default defineConfig({
  security: {
    allowedDomains: [{}],
  },
})

Correct

Allow an explicit trusted hostname

typescript
export default defineConfig({
  security: {
    allowedDomains: [
      { hostname: 'www.example.com', protocol: 'https' },
    ],
  },
})

Configuration

Project audits are configured in doctor.config.ts:

typescriptdoctor.config.ts
export default {
            rules: {
              'astro-doctor/no-open-allowed-domains': 'error', // or 'warn' or 'off'
            },
          }

All rules

Edit this page on GitHub ↗