title: How do DotNetOpenAuth whitelist and blacklists work?
body: <p>Does anyone have any documentation on DotNetOpenAuth and the way it handles while lists and black lists?</p>
  
  <p>My config  </p>
  
  <pre><code>&lt;untrustedWebRequest&gt;
          &lt;blacklistHosts&gt;
              &lt;add name="*" /&gt;
          &lt;/blacklistHosts&gt;
  
        &lt;whitelistHosts&gt;
          &lt;add name="www.mysite.ca" /&gt;
          &lt;add name="mysite.ca" /&gt;
          &lt;add name="devel.mysite.ca" /&gt;
          &lt;add name="devel.mysite.com" /&gt;
          &lt;add name="mysite.com" /&gt;
          &lt;add name="www.mysite.com" /&gt;
  
        &lt;/whitelistHosts&gt;
  
  
      &lt;/untrustedWebRequest&gt;
  </code></pre>
  
  <p>What I want is to have it cancel the request if it's any site not in the whilelist. I'm currently running version 2.5.49045 but plan to update soon.</p>
  
  <p>using </p>
  
  <pre><code>&lt;blacklistHostsRegex&gt; 
  &lt;add name=".*" /&gt;  
  &lt;/blacklistHostsRegex&gt;
  </code></pre>
  
  <p>blocked ever site even ones in the whitelist.</p>