Allowlist vs Denylist: When to use them

In software development, managing access to resources and features is a common challenge. Two common approaches to regulate access are the use of allow and deny lists. These strategies determine whether certain users, inputs, or systems are allowed or denied access, but they do so in opposite ways.

It's worth noting the recent shift in terminology within the software industry. Terms like 'allowlist' and 'denylist' are being adopted over the older 'whitelist' and 'blacklist' to promote more inclusive language. This shift reflects a broader industry trend toward fostering diversity and inclusivity in both coding practices and team dynamics.

What is Allowlist?

An allowlist is a list of entities (such as users, inputs, or services) that are explicitly permitted to access a feature or resource. If something is not on the allowlist, it is automatically denied access by default. They are often used to control access to:

• Feature Flags: Granting early access to new features for specific users or testers.
• APIs: Allowing only approved applications or users to interact with your API.
• Inputs: Ensuring only approved inputs or data formats are accepted by the system.

Advantages of Allowlisting

1. Tighter Control: Allowlisting provides a high level of security, allowing only pre-approved entities to access the system. This is ideal when the number of trusted users or inputs is limited and well-defined.

2. Improved Quality Assurance: When deploying a feature to a select group of users (such as beta testers), a allowlist ensures that only trusted individuals access it, minimizing unexpected issues.

3. Better Prevention of Abuse: Allowlists can prevent unauthorized or malicious access by ensuring only verified entities are granted permission.

Disadvantages of Allowlisting

1. High Maintenance: Managing an allowlist can be time-consuming, especially as the number of approved users, inputs, or services grows. Every new entity must be vetted and added manually.

2. Limited Flexibility: Legitimate users or inputs can be inadvertently excluded if not added to the list, which can cause delays or inconvenience during development.

3. Slower Iteration: For fast-moving projects, constantly updating the allowlist can slow down progress, especially when dealing with external partners or APIs that require regular changes.

What is Denylist?

A denylist is a list of entities that are specifically denied access, while everything else is permitted by default. In software development, denylisting is commonly used to:

• Block Unwanted Users: Preventing bad actors or known spammers from accessing an app or platform.
• Filter Out Bad Inputs: Rejecting harmful data, such as SQL injection attacks or cross-site scripting attempts.
• Control Feature Access: Disabling features for specific users who may have violated terms of service or encountered a known issue.

Advantages of Denylisting

1. Less Restrictive: Denylists allow for more flexibility, as they only block specific entities, letting new users or inputs flow through without needing explicit permission.

2. Easier to Implement: In fast-paced development environments, denylists are easier to manage because they require action only when there is something to block, rather than vetting each new user or input in advance.

3. Broader Access: Denylists are well-suited to systems with a wide range of users or inputs, where most entities are safe or acceptable, and only specific ones need to be blocked.

Disadvantages of Denylisting

1. Security Gaps: Denylists rely on identifying known issues or bad actors. If an attacker or harmful input isn't already on the list, it could slip through undetected.

2. Reactive Approach: Denylists tend to be reactive rather than proactive, as they focus on blocking known threats. New or evolving issues may go unnoticed until damage is done.

When to use Allowlists vs Denylists

• Allowlists: Use when you need tight control over access, such as rolling out features or managing critical resources.

• Denylists: Use when you have a broad user base or only need to block known threats and exceptions.

Real-world examples

The inspiration for discussing this topic came from two scenarios my team faced last month, where we had to choose between using an allowlist or a denylist.

1. Game Modes Tracking: In this situation, we needed to track specific features for different game modes. Each feature was tied to an allowlist of game modes where it made sense to exist. This way, if a new game mode was introduced, it wouldn’t automatically receive those features, preventing any potential information leaks.

2. Card Draw Source Tracking: The second scenario involved tracking whether a card was drawn generically or via a tutored draw (where specific cards are targeted). For tutored draws, revealing the source of the draw is crucial, while showing the source of a generic draw adds noise. We opted for a denylist in this case. If we missed identifying a card, it would result in showing unnecessary information (just noise, but not critical). With an allowlist, missing a tutored card would result in missing valuable information, which would have been much worse.

Conclusion

Choosing between allowlists and denylists depends on the specific requirements. If you need strict control and limited access, an allowlist offers higher security. For larger, more dynamic systems where the majority of users or inputs are safe, a denylist offers more flexibility. Both approaches have their pros and cons, but understanding when and how to apply them will help you manage access effectively in your software projects.