---
title: "Environment Security Concepts"
slug: "environment-security-concepts"
tags: ["administration", "security"]
updated: 2026-09-11T19:13:32Z
published: 2026-09-15T20:09:25Z
canonical: "docs.unqork.io/environment-security-concepts"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Security Concepts

Unqork environments include built-in security controls for the Express applications they host, including Content Security Policy (CSP), Cross-Origin Resource Sharing (CORS), session token management, and anonymous access. Each setting is managed in [Environment Administration](/unqorkai/docs/environment-administration).

## Content Security Policy (CSP)

A Content Security Policy is a browser-enforced security standard that controls which external resources an Express application is allowed to load. When a browser loads an Express application, it checks the policy before fetching any external content. Resources from sources not listed in the policy are blocked. CSP protects against content injection attacks and is especially relevant for environments that embed third-party content or permit user-generated HTML.

### Source Lists

Unqork exposes four CSP source lists, each controlling a different type of resource:

| Source List | Controls |
| --- | --- |
| **Frame Source List** | Which external URLs can be loaded inside `<iframe>` elements in Express applications. |
| **Frame Ancestors List** | Which external URLs are allowed to embed this Unqork environment inside their own `<iframe>`. |
| **Object Source List** | Which URLs can serve content for `<object>`, `<embed>`, and `<applet>` elements, typically used for legacy plugins. |
| **Image Source List** | Which URLs can serve images displayed in Express applications. |

Each field accepts a comma-separated list of hostnames, up to 2,000 characters. For example, enter `cdn.example.com`, not `https://cdn.example.com/path`.

> [!WARNING]
> Overly permissive CSP settings reduce the protection CSP provides. Only add sources that are actively needed.

## Cross-Origin Resource Sharing (CORS)

Browsers enforce a default security rule called the same-origin policy, which prevents a web page from making requests to a different domain than the one that served it. CORS selectively relaxes this restriction: when a request comes in from a different origin, the browser checks whether that origin is listed in the server's CORS configuration and either permits or blocks it.

In Unqork, CORS configuration controls which external origins are allowed to make API requests to the environment. This is commonly needed when:

- A third-party application or website must call Unqork APIs directly.
- A separate front-end application hosted on a different domain interacts with Unqork.
- Integration testing tools running on a different origin need API access.

Enter allowed origins as a comma-separated list, up to 2,000 characters.

> [!WARNING]
> Avoid using a wildcard (`*`) as the allowed origin in production environments. Wildcards allow any origin to make requests, which removes the protection CORS is intended to provide.

## Session Tokens

Unqork manages end-user sessions using a JSON Web Token (JWT) with two embedded expiration times:

- **Inactivity expiration**: How long the JWT remains valid after the last user action. When this expires, a new JWT is issued automatically as long as the session hasn't reached its maximum lifetime.
- **Maximum lifetime**: The absolute maximum duration of a session, regardless of activity. When this expires, the end-user must log in again.

The **Inactivity Timeout** setting controls the inactivity expiration. A shorter timeout improves security by ending idle sessions quickly. The **Session Timeout** setting controls the maximum session lifetime, ensuring that even active end-users must re-authenticate periodically.

## Anonymous Access

By default, Express applications can be accessed without authentication, a behavior called anonymous access. Anonymous access is useful for public-facing applications like contact forms or informational pages. Enabling **Disable Anonymous Access** requires all end-users to authenticate before accessing any Express application in the environment, and is appropriate when all content is intended for authenticated users only.

---

**Changelog**

| Date | Change |
| --- | --- |
| — | Initial publication. |

The Unqork front-end application framework that delivers Creator-built applications to end-users. Express is the layer end-users interact with—the published forms, screens, and navigation built in the Module Builder. Express is distinct from Express View, which is a Creator-facing preview tool in the IDE.

A CSP (cloud service provider) is a company that delivers cloud computing services like storage, databases, and infrastructure to organizations over the internet, allowing users to access computing power, data storage, and applications on demand without managing their own physical hardware, typically paying only for the resources they use.

Cross-Origin Resource Sharing (CORS) lets you control access to resources located outside a given domain.

Fetching is the process of retrieving data from a database, making it available to the application and the end-user.

HTML (Hyper Text Markup Language) is the standard markup language for for achieving font, color, graphic, and hyperlink effects when creating web pages.

Elements are are what you use to build Unqork applications. Elements include modules, workflows, Data Collections, Data Schema, and Record Collections.

APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services.

APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services.

End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product.

A JSON Web Token is an Internet standard for creating data with optional signature and/or optional encryption whose payload holds JSON that asserts some number of claims. Tokens are signed either using a private secret or a public/private key.

End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product.