Environment Security Concepts

Unqork environments include built-in security controls for the Express applications they host, including Content Security Policy (CSP), Cross-Origin Resource Sharing (CORS), session token management, and anonymous access. Each setting is managed in Environment Administration.

Content Security Policy (CSP)

A Content Security Policy is a browser-enforced security standard that controls which external resources an Express application is allowed to load. When a browser loads an Express application, it checks the policy before fetching any external content. Resources from sources not listed in the policy are blocked. CSP protects against content injection attacks and is especially relevant for environments that embed third-party content or permit user-generated HTML.

Source Lists

Unqork exposes four CSP source lists, each controlling a different type of resource:

Each field accepts a comma-separated list of hostnames, up to 2,000 characters. For example, enter cdn.example.com, not https://cdn.example.com/path.

Important: Overly permissive CSP settings reduce the protection CSP provides. Only add sources that are actively needed.

Cross-Origin Resource Sharing (CORS)

Browsers enforce a default security rule called the same-origin policy, which prevents a web page from making requests to a different domain than the one that served it. CORS selectively relaxes this restriction: when a request comes in from a different origin, the browser checks whether that origin is listed in the server's CORS configuration and either permits or blocks it.

In Unqork, CORS configuration controls which external origins are allowed to make API requests to the environment. This is commonly needed when:

• A third-party application or website must call Unqork APIs directly.
• A separate front-end application hosted on a different domain interacts with Unqork.
• Integration testing tools running on a different origin need API access.

Enter allowed origins as a comma-separated list, up to 2,000 characters.

Important: Avoid using a wildcard (*) as the allowed origin in production environments. Wildcards allow any origin to make requests, which removes the protection CORS is intended to provide.

Session Tokens

Unqork manages end-user sessions using a JSON Web Token (JWT) with two embedded expiration times:

• Inactivity expiration: How long the JWT remains valid after the last user action. When this expires, a new JWT is issued automatically as long as the session hasn't reached its maximum lifetime.
• Maximum lifetime: The absolute maximum duration of a session, regardless of activity. When this expires, the end-user must log in again.

The Inactivity Timeout setting controls the inactivity expiration. A shorter timeout improves security by ending idle sessions quickly. The Session Timeout setting controls the maximum session lifetime, ensuring that even active end-users must re-authenticate periodically.

Anonymous Access

By default, Express applications can be accessed without authentication, a behavior called anonymous access. Anonymous access is useful for public-facing applications like contact forms or informational pages. Enabling Disable Anonymous Access requires all end-users to authenticate before accessing any Express application in the environment, and is appropriate when all content is intended for authenticated users only.