Perhaps I do not understand this feature but I am trying to restrict so that only localhost can use the ARI on port 8088.
Here’s my configuration, I have tried both allowed_origin http://localhost:8088 and without protocol localhost:8088
[general] enabled = yes allowed_origins = http://localhost:8088 [ariuser] type=user read_only=no password_format=plain password=1234
Despite having this I can still send requests remotely like this
curl http://my-test-asterisk.com:8088/ari/channels -u ariuser:1234
<--- ARI request received from: 220.127.116.11:49388 ---> Host: my-test-asterisk.com:8088 Authorization: Basic YXJpdXNlcjoxMjM0 User-Agent: curl/7.88.1 Accept: */* body: <--- Sending ARI response to 18.104.22.168:49388 ---> 200 OK Content-type: application/json 
Is there a way to limit ARI access to localhost, but having WS exposed externally?
Asterisk version 20.3.0