alphagov/whitehall — comment on commit 302e46846fe1db3635538ddffd336b830f2afda8
File:  line 0
By floehopper:

Yes it would be, but I think it's an optimisation. Whatever happens we'll want it to be blocked at the Ruby/application level. First we're going to look at a better solution at the Ruby/application level where we reject any admin requests that have come through the router. The benefit of this will be the app won't need to know what domains to allow and will be resilient to changes to the domains.