The allowlist should be origin domains that are allowed to send the requests, not the list of forwarded hosts (i.e. reverse proxies).