diff --git a/platform/built-in-server/src/org/jetbrains/ide/RestService.java b/platform/built-in-server/src/org/jetbrains/ide/RestService.java
index bae7bc59c24d..1afdbc1bacd7 100644
--- a/platform/built-in-server/src/org/jetbrains/ide/RestService.java
+++ b/platform/built-in-server/src/org/jetbrains/ide/RestService.java
@@ -26,7 +26,6 @@ import com.google.gson.stream.JsonReader;
 import com.google.gson.stream.JsonWriter;
 import com.google.gson.stream.MalformedJsonException;
 import com.intellij.ide.IdeBundle;
-import com.intellij.openapi.application.ApplicationManager;
 import com.intellij.openapi.diagnostic.Logger;
 import com.intellij.openapi.project.Project;
 import com.intellij.openapi.project.ProjectManager;
@@ -50,6 +49,7 @@ import io.netty.channel.ChannelHandlerContext;
 import io.netty.handler.codec.http.*;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
+import org.jetbrains.builtInWebServer.BuiltInWebServerKt;
 import org.jetbrains.io.NettyKt;
 import org.jetbrains.io.Responses;
 
@@ -178,6 +178,10 @@ public abstract class RestService extends HttpRequestHandler {
 
   // e.g. upsource trust to configured host
   protected boolean isHostTrusted(@NotNull FullHttpRequest request) throws InterruptedException, InvocationTargetException {
+    if (BuiltInWebServerKt.isSignedRequest(request)) {
+      return true;
+    }
+
     String referrer = NettyKt.getOrigin(request);
     if (referrer == null) {
       referrer = NettyKt.getReferrer(request);
@@ -199,8 +203,6 @@ public abstract class RestService extends HttpRequestHandler {
       else {
         isTrusted.set(trustedOrigins.getIfPresent(host));
       }
-    } else if (ApplicationManager.getApplication().isUnitTestMode()) {
-      isTrusted.set(Boolean.TRUE);  // make the tests pass
     }
 
     if (isTrusted.isNull()) {
diff --git a/platform/built-in-server/testSrc/RestApiTest.kt b/platform/built-in-server/testSrc/RestApiTest.kt
index 8b01e8431c32..4839893924c3 100644
--- a/platform/built-in-server/testSrc/RestApiTest.kt
+++ b/platform/built-in-server/testSrc/RestApiTest.kt
@@ -64,9 +64,11 @@ internal class RestApiTest : BuiltInServerTestCase() {
     val column = manager.annotation?.column ?: -1
 
     var connection = URL("$serviceUrl?file=${manager.filePath ?: ""}&line=$line&column=$column").openConnection() as HttpURLConnection
+    BuiltInServerManager.getInstance().configureRequestToWebServer(connection)
     assertThat(HttpResponseStatus.valueOf(connection.responseCode)).isEqualTo(expectedStatus)
 
     connection = URL("$serviceUrl").openConnection() as HttpURLConnection
+    BuiltInServerManager.getInstance().configureRequestToWebServer(connection)
     connection.requestMethod = "POST"
     connection.doOutput = true
     JsonWriter(connection.outputStream.bufferedWriter()).use {