Add config option to enforce allowlist for Slack/Teams notifications

[ryan-carroll-graylog]

Description

• Removes the disabling of redirects. We are not doing this anywhere else currently and will explore it further later (See URL allowlist handling for notifications #26619 (comment))
• Adds a config option to enable enforcement of the URL Allowlist for Slack and Teams notifications to System > Configuration > URL Allowlist defaulting to disabled

After Graylog is upgraded, if there are Slack or Teams Notifications using webhook URLs that are not in the allowlist, a warning will be logged directing users to optionally add Slack/Teams Notifications to URL Allowlist enforcement:

2026-07-29 11:11:22,163 WARN : org.graylog2.system.urlallowlist.UrlAllowlistValidator - Notification is using a URL which is not allowlisted. Enable "Enforce for Slack & Teams notifications" in System > Configurations > URL Allowlist to block non-allowlisted URLs. [url: https://asdfasdf, notification: NotificationTestId]

Motivation and Context

Follow on to #26619

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactoring (non-breaking change)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have requested a documentation update.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.

[ryan-carroll-graylog]

@boosty please let me know if this all looks ok to you.

I went with a System config option since it seemed like something an admin would want to flip on to enforce across the board, and the individual notification configs already warn if an individual URL is not whitelisted as of the previous PR (although not prevented from creating the config anyway)

If you had something else in mind I'm happy to tweak it.

[boosty]

Thanks for working on this!

Left a few comments.

I am missing a test for the new behaviour of graylog2-server/src/main/java/org/graylog2/system/urlallowlist/UrlAllowlist.java.

[ryan-carroll-graylog]

Thanks @boosty , yeah I think the comment was out of place and confusing.

My intent is to capture that we've added this global looking opt in/out config field, but it's really just affecting the Slack/Teams notifications right now, and that it should go away at the next major release when we just enforce URL allowlist across the board.

I moved the relevant bits to the new enforce_for_notifications field in UrlAllowlist where it's a better fit, and removed the noise as you're right that it can be easily inferred.

Please lmk if that makes sense to you.

[boosty]

Thanks @ryan-carroll-graylog. In general I am happy about making this a config option.

I would leave the rest of the code review and testing to your team.

But my comment above remains: The change in graylog2-server/src/main/java/org/graylog2/system/urlallowlist/UrlAllowlist.java calls for a unit test.

[ryan-carroll-graylog]

Thanks @ryan-carroll-graylog. In general I am happy about making this a config option.

I would leave the rest of the code review and testing to your team.

But my comment above remains: The change in graylog2-server/src/main/java/org/graylog2/system/urlallowlist/UrlAllowlist.java calls for a unit test.

Apologies I missed the test on my commit, just added. Thanks for taking a look @boosty !