You have to login with your account first.
I'm able to enter invalid strings for the block-/allowlist. Filter on both, frontend, backend and manager server.