no-open-allowed-domains

Why it matters

An empty allowed-domain pattern matches every host and defeats the protection that security.allowedDomains is intended to provide. List the exact hostnames or constrained wildcard patterns that should be trusted.

See the difference

export default defineConfig({
  security: {
    allowedDomains: [{}],
  },
})

export default defineConfig({
  security: {
    allowedDomains: [
      { hostname: 'www.example.com', protocol: 'https' },
    ],
  },
})

Configure this check

Project audits are configured in doctor.config.ts:

export default {
  rules: {
    'astro-doctor/no-open-allowed-domains': 'error',
  },
}

Use 'error', 'warn', or 'off'. The configuration guide covers presets and per-file overrides.

Keep exploring security

• no-set-htmlAvoid set:html to prevent cross-site scripting (XSS) vulnerabilities.
• no-public-secret-envWarn when PUBLIC_ environment variables appear to contain secrets.
• no-disabled-origin-checkKeep Astro's built-in CSRF origin check enabled.
• no-insecure-session-cookieKeep secure, HTTP-only, same-site session cookie protections enabled.
• require-action-input-schemaValidate untrusted Astro Action input before the handler runs.

Browse every rule and project audit