Best Practices: Configuration Security

Overview

Unqork's security best practices are important for building applications using the Unqork Designer Platform. Follow the best practices listed below if your application captures sensitive data (PII Personal Identifiable Information (PII) is any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.), uses schema modules to store submission data, contains external integrations using API APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services. (Application Programming Interface) calls, or opens API modules for external access.

Application configuration security best practices covers modules, components, and workflows.

General Configuration Best Practices

Data Collections

Data collections are static data tables referenced by application modules. The data collections can be accessed either server-side, client-side, or both.

To learn more about data collections, visit our Workspaces: Working with Reference Data article.

Best practices for data collections include:

Privilege Escalation

Privilege escalation flaws let end-users elevate access and gain access to protected data. The privilege escalation vulnerability is common in software applications including ones built by no-code platforms.

Common mistakes leading to potential privilege escalation vulnerabilities in an Unqork application include:

To prevent privilege escalation:

  • Design strong RBAC controls for applications.

To learn more about implementing RBAC (Role-Based Access Control), visit our Introduction to Role-Based Access Control (RBAC) For Express View article.

Input and Data Validation

Application misconfiguration lets users bypass input validation to save/access data, including:

To prevent input/data validation vulnerabilities

  • Add validation before module submission requests that are executed by the client or browser.

  • When possible, validate data in a server-side module.

Module Best Practices

Act As Super-User When Server Side Executing

The Act as Super-user when Server Side Executing setting grants non-administrative users privilege to run as an administrative user with full access to submissions including the submissions the current users don’t have access to.

To learn more about Server-Side execution, visit our Server-Side Module Execution article.

Using the Other Module Type and Connecting to External APIs

Create schemas using the  O  modules with the following settings:

  • Enable Server-side Execution Only in the module setting for external API service endpoints that are configured in server administration.

  • Enable Customize RBAC for this Module in module permissions.

  • Disable Allow Access to Anonymous Users in module permissions.

To learn how build API modules, visit our API Specification Snippet article.

Empty Modules

Modules can be saved with no components in them. There is no security risk with empty modules but it is best practice to remove empty modules from an environment.

Imported Module References

Remove all references to a deleted module. If you delete an imported module, the references to the deleted imported module are not automatically deleted. References to deleted imported modules can cause runtime issues.

Modules in an Automated Workflow

Create modules in the Automated Workflow lane with the following settings:

To learn more about Automated Workflows, visit our Swimlane Management article.

Module With Anonymous User Access

Modules enabled for anonymous users with module permission setting Access to Anonymous Users are accessible without authentication.

  • Limit modules with anonymous user access including login and homepages.

  • Avoid accessing sensitive data or execute external APIs in modules with anonymous user access.

Schema Modules

The Schema module defines properties of a submission, access to them, and how they relate to other submissions within an application.

To learn more about using schema modules, view our Schema Docs Dashboard Tool article.

Create schema modules with the following settings to improve security:

  • Tag the Schema module with the keyword schema. Schema tagged modules are accessible in the Schema Docs Dashboard Tool.

  • For  O  modules, enable the Server-side Execution Only (SSE) in Module Settings. SSE prevents users from accessing sensitive data stored module.

A static image displaying an Other-type module's Server side execution setting.

A static image displaying a Module's User Permissions settings.

Components and Operators Best Practices

File Component

  • Avoid using * for the file formats. Instead, specify file acceptable formats like .pdf, and .jpg. Limiting formats prevents executables, scripts, and other potentially malicious content from uploading to your application.

A static image displaying the File component's Accepted File Formats setting.

  • Set the maximum file upload size. Restricting file size prevents unexpectedly large files from causing your application to fail.

To learn more about the File component, visit our File Component article.

File Storage Component

  • Use the SFTP file storage type, don’t use FTP. SFTP provides additional security during the data transfer process.

    Unqork only supports the FTP file storage type for legacy system file transfers that are unable to use SFTP.

  • Enable Server-side Execution Only for the services used in the File Storage component. Enabling SSE prevents the exposure of sensitive information.

To learn more about the File Storage component, visit our File Storage Component article.

Data Workflow HTML Table Operator

Enable the Enable HTML Encoding setting to prevent code snippets in user input execution. HTML Encoding helps mitigate vulnerabilities like XSS Cross Site Scripting attacks vulnerability used by malicious entities to bypass the access controls of a website. (Cross-site scripting) injections.

A static image displaying the HTML Table operator's settings.

To learn more about the HTML Table operator, visit our HTML Table Operator article.

Excel Export

A common use case is to export data as an Excel file. To implement the Excel export functionality, convert table data to HTML in a Data Workflow and using an HTML table in the Content component.

Resources