Skip to main content

Which origins are allowed

An origin in Paradarum is just a host string plus an optional Host Header and an SSL-verify boolean. This page is the complete reference for what that host string may contain.

No origin types

There is no origin-type enum and no S3 / cloud-bucket origin kind. The "type" of an origin is implied entirely by the scheme prefix you put in the host (for example https://). Everything is expressed through the single host value.

Accepted host forms​

The origin host field accepts a broad set of forms. All of the following are valid:

FormExampleNotes
Plain hostnameexample.comMust have a TLD of 2+ letters.
Hostname with portorigin.example.com:8080Any port is accepted.
IPv4203.0.113.10Private/reserved IPs are blocked — see below.
IPv4 with port203.0.113.10:4000
IPv6 in brackets[2001:db8::1]IPv6 literals must be wrapped in square brackets.
IPv6 with port[2001:db8::1]:443
http:// schemehttp://origin.example.com:4000
https:// schemehttps://example.comUse this (or :443) for a TLS origin on 443.
h2c:// schemeh2c://203.0.113.10Server only — see the warning below.
Port rangeorigin.example.com:8001-8006A :port may be followed by a -port range suffix.
h2c:// is server-side only

The CDN's normalizer accepts h2c:// (cleartext HTTP/2), but the panel's client-side validator only matches an optional https?:// prefix. If you type an h2c:// origin in the panel it will fail client validation even though the server would accept it.

Port normalization​

If the host has no scheme and no port, the API appends :80:

example.com        ->  example.com:80
origin.example.com ->  origin.example.com:80
Plain hostnames default to port 80

A bare example.com becomes example.com:80 — even if you intended an HTTPS origin. To reach a TLS origin on 443 you must be explicit:

example.com:443
https://example.com

Blocked origins​

The following origin values are rejected by the API to prevent Server-Side Request Forgery (SSRF) and protect internal infrastructure:

Blocked rangeReason
127.0.0.0/8 (localhost, 127.0.0.1)Loopback — would reach services on the CDN node itself.
10.0.0.0/8Private network (RFC 1918).
172.16.0.0/12Private network (RFC 1918).
192.168.0.0/16Private network (RFC 1918).
169.254.0.0/16Link-local — includes cloud metadata endpoints (169.254.169.254).
0.0.0.0Unspecified address.
100.64.0.0/10Carrier-grade NAT (shared address space).
224.0.0.0/4 – 239.x.x.xMulticast.
240.0.0.0/4 and aboveReserved for future use.
::1, fe80::/10, fc00::/7IPv6 loopback, link-local, and unique local addresses.
Unix sockets (unix/…)Not allowed as user-configured origins.

If you attempt to set a blocked origin, the API returns:

400  Private or reserved IP address '...' is not allowed as an origin server.
DNS rebinding protection

Even if a hostname passes API validation, the edge resolves the hostname on every request and blocks the connection if it resolves to a private or reserved IP. This prevents DNS rebinding attacks where a public domain is pointed at a private address after passing initial validation.

Rejected forms​

  • A bare single-word host other than localhost (for example backend with no dot) is rejected — domain names need a TLD of 2 or more letters.
  • Private or reserved IP addresses and localhost are rejected — see Blocked origins above.
  • Unix sockets (unix/…) are not allowed.
  • Values that don't match the accepted forms above show Invalid hostname format! in the panel.

Putting it together​

You set the origin host in the property's General → Origin Server card. Alongside the host, an origin carries an optional Host Header override, an SSL-verify toggle, and an enabled flag — see origin & host header.