v0.31.4

src/proxy/cache_helpers.rs

@@ -181,8 +181,9 @@ fn response_context(
 }
 
 /// Reserved administration-session cookies may cross the proxy boundary only
-/// for the explicit self-admin deployment: HTTPS, an explicitly allowed public
-/// administration hostname, a backend that directly targets the configured
+/// for the explicit self-admin deployment: HTTPS, a specifically allowed
+/// administration hostname (extra DNS list or pinned public HTTPS origin),
+/// a backend that directly targets the configured
 /// administration listener, and the existing local-listener risk opt-in.
 fn admin_session_passthrough(
     snapshot: &crate::config::Snapshot,
@@ -196,9 +197,7 @@ fn admin_session_passthrough(
             .envelope
             .config
             .administration
-            .allowed_hosts
-            .iter()
-            .any(|allowed| allowed.eq_ignore_ascii_case(host))
+            .explicitly_allowed_panel_host(host)
 }
 
 fn apply_response_rules(