Order of security features verification

This document describes the order in which security features are processed and verified in Alokai@Edge. Understanding this sequence is important for configuring and troubleshooting access control and security mechanisms.

Order of Security Features Verificationri:link

1. IP Access List
   Incoming requests are first checked against a list of allowed or blocked IP addresses. Requests from disallowed IPs are immediately rejected. Read more about IP access list
2. Header Access List
   If the request passes the IP check, it is then verified against allow and block lists for specific HTTP headers. Only requests that meet the allow list criteria and are not on the block list are allowed to proceed. Read more about Header access list
3. Basic Authentication
   After passing the header check, the request is challenged for basic authentication credentials. Only requests with valid username and password combinations are permitted. Read more about Basic Auth
4. Maintenance Mode
   If maintenance mode is enabled, all requests (except those from whitelisted sources) are blocked, and a maintenance response is returned. Header access list