Repositories are still visible when IP whitelisting is enabled

Question

Hi, we've enabled IP whitelisting for our Bitbucket cloud workspace, yet we are still able to navigate to the workspace from the Internet and see all the repositories in that workspace.  The Internet IPs we are coming from are not in the whitelist.  When accessing any of the repositories, we do not get a error, but the window just spins indefinitely, is this expected?  I would expect that IP whitelisting at a workspace level would prevent any devices that are not in the whitelist to not be access to access the workspace, yet alone have visibility to see any the repositories in that workspace.  I've looked through the documentation, but it's not clear what we should expect here.

Thanks.

Patrik S · Accepted Answer

Hello @MacDonald, Lee ,

Welcome to Atlassian Community!

When the IP allow listing feature is enabled for a workspace, the users with access to the workspace will still be able to access the workspace main page, where the repositories will be listed, independently if their IPs are included in the allowlist.

However, the users accessing from non-allow listed IPs will not be able to load any repositories or other pages of the workspace, nor clone/push or execute API calls. When trying to access a repository in the UI, non-allow listed IPs should receive a message that the IPs are currently not in the allow list.

If you navigate to the workspace and select a repository using a non-allow listed IP, it will try to load the repo and spin indefinitely because an API call to the backend was already Unauthorized, so it will end up not loading the page. However, if you refresh the page or access the repository URL directly, you should receive a message saying this IP is blocked from accessing the content.

Hope that helps to clarify your questions!

Thank you, @MacDonald, Lee !

Patrik S