**TL;DR**: When upgrading from `Bitcoin Core 0.20.1` to `Bitcoin Core 0.21.0`, a downstream application using the HTTP JSON-RPC API started getting HTTP 403 "Forbidden".

Turns out it is because I have `rpcallowip=::/0` in `bitcoin.conf` which used to work but does not anymore.
As a workaround, `rpcallowip=0.0.0.0/0` works.

-----

I run bitcoind in docker container1, and some application using the HTTP JSON-RPC API of bitcoind is in docker container2. They are on the same "docker network".

In `bitcoin.conf` I have:
```
rpcauth=<...>
rpcbind=0.0.0.0:8332
rpcallowip=::/0
```
(bitcoind RPC is not actually exposed to the public internet; it is up to the docker layer and above to ensure this.)

The application in container2 is connecting through HTTP accessing an URL such as `http://user:pass@172.19.1.10:8332/`.

This setup used to work when running `Bitcoin Core 0.20.1` in container1.

It no longer works with `Bitcoin Core 0.21.0`.

-----

If I change my `bitcoin.conf` as below, it starts working again using 0.21:
```
rpcauth=<...>
rpcbind=0.0.0.0:8332
rpcallowip=0.0.0.0/0
```

So `rpcallowip=::/0` used to work but does not anymore; `rpcallowip=0.0.0.0/0` works.

-----

Easy way to test:
`curl --data-binary '{"jsonrpc":"1.0","id":"curltext","method":"getblockchaininfo","params":[]}' -H 'content-type:text/plain;' http://user:pass@172.19.1.10:8332/`
const uint256 asmap_version = SerializeHash(asmap);
            LogPrintf("Using asmap version %s for IP bucketing\n", asmap_version.ToString());
        } else {
            LogPrintf("Using 16 prefix for IP bucketing\n");
        }
        
        assert(!node.netgroupman);
        node.netgroupman = std::make_unique<NetGroupManager>(std::move(asmap));
        
        assert(!node.addrman);
        uiInterface.InitMessage(_("Loading P2P addresses…").translated);
        auto addrman{LoadAddrman(*node.netgroupman, args)};
        if (!addrman) return InitError(util::ErrorString(addrman));
        node.addrman = std::move(*addrman);
    }
    assert(!node.banman);
    node.banman = std::make_unique<BanMan>(args.GetDataDirNet()  "banlist", &uiInterface, args.GetIntArg("-bantime", DEFAULT_MISBEHAVING_BANTIME));
    assert(!node.connman);
    node.connman = std::make_unique<CConnman>(GetRand<uint64_t>(),
                                              GetRand<uint64_t>(),
                                              *node.addrman, *node.netgroupman, args.GetBoolArg("-networkactive", true));
    assert(!node.fee_estimator);
     
     
    if (!peerman_opts.ignore_incoming_txs) {
        bool read_stale_estimates = args.GetBoolArg("-acceptstalefeeestimates", DEFAULT_ACCEPT_STALE_FEE_ESTIMATES);
        if (read_stale_estimates && (chainparams.GetChainType() != ChainType::REGTEST)) {
            return InitError(strprintf(_("acceptstalefeeestimates is not supported on %s chain."), chainparams.GetChainTypeString()));
        }
        node.fee_estimator = std::make_unique<CBlockPolicyEstimator>(FeeestPath(args), read_stale_estimates);