Origin access policy

Public policy permits HTTP and HTTPS only. It rejects:

embedded credentials;
private, loopback, link-local, multicast, reserved, carrier-grade NAT, and documentation ranges;
non-standard ports;
excessive redirects;
oversized decompressed bodies;
requests exceeding time budgets.

The controlled test origin requires an explicit local-only switch:

bin/tw observe \
  --url http://127.0.0.1:18080/product/sku-001 \
  --allow-loopback

Do not expose --allow-loopback in a public API or user-controlled service configuration.

Every redirected request passes through URL validation again, and the dialer connects directly to a validated resolved address.

Last modified on August 10, 2026

⌘I