Environment Administration

Google Tag Manager

Unqork supports integration with Google Tag Manager containers for Google Analytics tag configurations. You can use tags for several purposes, including:

• Scroll tracking.

• Monitoring module submissions.

• Conducting surveys.

• Generating heat maps.

• Tracking how end-users access your site.

The Google Tag Manager section of the Environment Administration page includes three fields:

• GTM Container ID

• GTM Environment Authentication

• GTM Environment Preview

Only use the GTM Environment Authentication and GTM Environment Preview settings if you have multiple environments set up in Google Tag Manager.

To learn more about environments in Google Tag Manager, see Google Tag Manager's Environments documentation: https://support.google.com/tagmanager/answer/6311518/environments?hl=en.

Another solution for running different tags in different Unqork environments is to create one Tag Container for each Unqork environment. Then, add the environment-specific Container ID to each environment's Environment Administration page.

When you create a new Tag Container, Google Tag Manager prompts you to copy and paste the Tag Manager Snippet Script to every page of your website. Unqork performs this step for you. You only need to add the Container ID to your environment once.

Unqork API

Unqork has its own API that lets you request and send data between systems. To use it, you must authenticate using an access token.

By enabling OAuth2 Password Grant in Environment Administration, your Unqork users can obtain an access token using their login credentials to make API calls.

Authentication

This section focuses on the authentication settings you can use to customize your environment. These settings include username and password requirements, anonymous user access, and SAML and OIDC configuration.

To learn more about SSO (Single Sign-On), SAML, and OIDC authentication, view our Single Sign-On (SSO) Management articles.

Using the menu below, select a setting:

Username & Password

These settings let you disable your environment's login page, enforce password resets, and configure specific character and character length requirements when users create a password.

Disable Login Screen

The Disable Login Screen setting prevents users from logging into Designer or Express View. This is helpful for administrators who plan to use login methods, like SSO.

Enabling the Disable Login Screen setting still displays the login screen, but users entering their credentials are shown a modal informing them that the login screen is disabled.

Password Requirements

To customize your environment's password requirements, use the following settings in this section. Then, save your changes.

Password reset rules do not apply to Service users. Service users can create user credentials for API calls and authorizations. Service users access server-side logic instead of the front-end of your application. Password reset rules only apply to regular Express end-users.

Strength

The strength indicator informs administrators how secure their password settings are. There are two levels of indication:

• Good: The environment password settings follow security guidelines.

• Weak: An improvement can be made. Review the warning callout below the Strength setting for more details.

API Rate Limit

Improve integration security by limiting the API rate. You can limit the number of API requests from any single IP address per server per 60 seconds.

The minimum number of requests you can enter is 100, while the maximum is 1,000,000. It's recommended to set this to a lower number to reduce the likelihood of automated attacks. Common attacks include brute-force searches, enumerations, or HTTP request flooding.

The default API rate limit is 1000.

Execution Limit

An execution limit is the number of retries a component or Workflow node attempts in a server-side execution. This setting is a helpful defense mechanism built into each environment.

Server-side execution requests have a two-minute timeout. If the module being executed has a configuration containing a larger number of components or Workflow node executions, it might timeout if the execution limit is too high.

Execution limits (or looping limits) prevent infinite loops in the form of two looping limit settings:

• Looping Limit for Component Execution: The looping limit specific to component executions. By default, this value is set to 100 retries.

• Looping Limit for Workflow Node Execution: The looping limit is specific to Workflow node executions. By default, this value is set to 100 retries.

Express Content Security Policy (CSP)

Content Security Policy (CSP) is a security standard that informs the browser to allow or block loading content for a given site. For example, let's say you set up an iframe in your Unqork application that displays content from another site. You can use CSP to inform the browser that it's safe to load content from that site in your Unqork application. By default, Unqork environments have strict CSP settings. These settings help protect against threats, like data injection attacks. Only hostnames added to your CSP settings can load content into or out of your Unqork application.

To learn more about each directive, view the Mozilla developer CSP documentation: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy.

You can set up the following CSP directives in Environment Administration:

Express Session Administration

This section lets you determine how to control sessions in Designer and Express. For example, when end-users log into an environment, they obtain an access token. This token verifies they have permission to log into your environment. But, the token only remains active for a set amount of time. After that time, Unqork logs them out, and they must log in again.

If your end-user leaves their device unattended while remaining logged in, this setting prevents someone from obtaining your end-user's token and using it indefinitely.

To customize your environment's session requirements, use the following settings in this section. Then, save your changes.

Cross-Origin Resource Sharing (CORS)

The Cross-Origin Resource Sharing (CORS) setting lets you indicate a domain other than your environment domain where you can permit the loading of resources. In Unqork, this setting is helpful when using the Embedded User Interface (UI) feature.

To allow multiple domains, use a comma-separated list.

To learn more about Embedded UI, view our Embedded User Interface (UI) article

Offline Mode

The Enable Offline setting is only available in older environments.

The Enable Offline setting enables offline access at the environment level. Enabling this setting lets you access offline-mode tools and features to:

• Automatically register a service worker. Setting up this service worker lets your offline-enabled modules connect to the IndexedDB API.

• Enable the Module Builder's Cache this Module to Allow for Offline Access setting.

End User Account Password

The Express User Account Password setting controls password creation for new Express users. Administrators can create passwords for new Express users or let Express users create their own passwords. To improve environment and application security, you'll use the Let User Set Password on Login setting. After making changes, save them.

The Choose Password setting is only available in older environments.

Component Security

The Disable Safe HTML Filters in Content Components setting prevents the use of the safehtml AngularJS filter in Content components. When enabled, Content components bypass safehtml filters in Express View.

Environments that do not have a Content Component might not have this setting in their Environment Administration page.

Best Practices

Using the menu below, select a best practice to explore.

Server-Side Execution Request/Response Body and Debug Logs

The Server Side Execution Request/Response Body Log enables the logging of request and response bodies for all server-side execution modules.

• In Production-level environments, disable logging by selecting the option Do Not Capture Request/Response Bodies. Doing so prevents logs from capturing and storing PII data.

  

• When debugging, enable Always Capture Debug Logging to capture logs for troubleshooting. Then, disable the setting once the debugging is completed.

  

Enable OAuth2 Password Grant

Disable the Enable OAuth2 Password Grant setting for all users. Create a dedicated Express Service user for API access. Disabling this setting prevents phishing attacks and increases security for users.

Password Requirements

Enforce a strong password policy in all environments. A weak password is vulnerable to brute-forcing or password spraying attacks.

• In the Minimum Length field, set a minimum password length of at least 12 characters.

• Select the Require Lowercase Letter, Require Uppercase Letter, Require Number, and Require Symbol settings to improve password security.

  

API Rate Limiting

• Improve integration security by limiting the API rate.

• The smallest number of requests you can enter is 100. It's recommended to set this to a lower number to reduce the likelihood of automated attacks, like brute-force searches, enumerations, or HTTP request flooding.

Session Administration

Enforce a strong session management policy by making the following changes to the Session Administration setting section:

1. From the Expire User Sessions in Express drop-down, select Expiration on Browser Quit. By selecting this option, you set all browser cookies to session cookies. Once the browsing session ends, your browser automatically deletes the session cookies.

   

2. Set your Inactivity Timeout and Session Timeout to a lower number. Setting a shorter amount of time for the session to timeout increases security, reducing the likelihood and amount of time a malicious actor can use a stolen session.