IP allowlists
An IP allowlist is a named list of your servers' addresses. A form in server mode accepts signed requests only from the addresses on its lists, so a leaked signing secret is useless from anywhere else. You manage them under Settings → IP allowlists.
Lists are shared by the forms of one organization: when a backend moves, you change one list instead of every form.
[!IMPORTANT] Allowlists protect server mode only. Requests from browsers (the embed snippet, the hosted page, your own frontend) come from your visitors' addresses and are never checked against them.
Creating a list
- Choose New list.
- Fill in the fields below.
- Pick Create.
| Field | What |
|---|---|
| Organization | Which organization's forms may use the list. Only asked when the desk has more than one; it can't be changed later. |
| Name | What the addresses are, such as "Production backends". |
| Description (optional) | Where the addresses come from, for whoever edits the list next. |
| Addresses | One per line. |
| The page lists each list with its first addresses and how many forms use it. Click a list to edit | |
| it. |
Addresses and ranges
Each line is one of:
| Entry | Example | Matches |
|---|---|---|
| An IPv4 address | 203.0.113.10 | That address only. |
| An IPv4 range | 198.51.100.0/24 | Every address in the range. |
| An IPv6 address | 2001:db8::10 | That address only. |
| An IPv6 range | 2001:db8::/48 | Every address in the range. |
The desk stores entries as ranges: a single address is saved as /32 (IPv4) or /128 (IPv6), and a range is
saved from its first address, so 198.51.100.7/24 becomes 198.51.100.0/24. Duplicates are dropped. A line that
isn't an address or range stops the save with a message naming it. A list holds up to 200 entries.
Behind a proxy
Use the address your server's requests come from as the desk sees it.
[!WARNING] If the desk runs behind a load balancer or proxy, it only believes the forwarded client address when the proxy is listed under Trusted proxies in Settings → Installation; otherwise every request seems to come from the proxy.
The Address column of a form's submission log shows the address the desk saw.
Attaching lists to a form
On the form's Security tab, under Server mode:
- Tick the lists under IP allowlist. You see the lists of the form's organization, with their addresses.
- Optionally add Extra addresses for this form, one per line, in the same format.
- Save the form.
The form accepts signed requests from all its ticked lists and its own entries together. The note below the fields shows the addresses that apply.
[!WARNING] When there are none, the note warns that signed requests are accepted from any address: the signature is then the only check.
A request from an address outside the allowlist is refused and logged as ip not allowed in the form's submission log.
Changing and deleting a list
Changes to a list apply to every form that uses it at once; the dialog says how many forms that is.
Delete removes the list after you confirm. The forms that used it stop accepting its addresses.
[!CAUTION] If a form has no other lists or entries left, it accepts signed requests from any address again. The confirmation names those forms, so you can add another list or entries to them first.