Blake 97af0f829b ops: Assert Host allowlist reject in validate-check ...

Empty-upstream Host allowlist is load-bearing: if that gate regresses,
the cache becomes an open LAN reverse proxy again. Unit tests already
cover hostAllowedForDirectFetch, but make validate-check did not probe
the live reject path.

Extend validate-check to GET a depot-like path with Host: evil.example
and a Steam User-Agent, requiring HTTP 400 Invalid URL. Document the
expected reject in README and the validate-config comment.

Fixes #37

2026-09-14 13:39:32 +00:00

..

validate-config.yaml

ops: Assert Host allowlist reject in validate-check

2026-09-14 13:39:32 +00:00