doc: add release note describing change for forbidden clients
What the developer wrote
Authored by Matthew Zipkin
doc: add release note describing change for forbidden clients
What changed, and why it matters
This commit only adds a release note documenting a prior behavior change: Bitcoin Core will now immediately drop remote clients blocked by the -rpcallowip setting, instead of sending them a '403 Forbidden' error page. The commit itself changes only documentation and contains no code.
No immediate action is required for this documentation commit. Review the underlying PR #35592 to confirm the actual code change behaves as described and that the disconnection logic correctly honors -rpcallowip defaults.
Security signals we found
Behavior change in access-control enforcement for RPC/REST interface
Immediate disconnection instead of 403 response reduces information leakage to unauthorized clients
No code change in this commit; security relevance is documentary only
Evidence from the diff
The diff creates doc/release-notes-35592.md, a release-notes file describing that RPC/REST clients from disallowed source addresses are immediately disconnected rather than receiving an HTTP 403 response. No functional code is modified in this commit; it is purely a documentation addition for an already-merged change (referenced by PR #35592).
Changed components
doc/release-notes-35592.mdRPC/REST HTTP interface (documented behavior only)Inspect captured patch +6 / −0
diff --git a/doc/release-notes-35592.md b/doc/release-notes-35592.md
new file mode 100644
index 00000000..e24eec31
--- /dev/null
+++ b/doc/release-notes-35592.md
@@ -0,0 +1,6 @@
+HTTP: RPC / REST
+----------------
+
+Clients attempting to connect from addresses not allowed by the `-rpcallowip`
+option (or its default, `localhost`) will now be immediately disconnected
+instead of receiving a `403 Forbidden`.
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.