Deployment protection
Restrict access to previews, unique deployment URLs, and non-current deployments.
Access protection controls who can open a deployment before application code runs. Easel currently provides this through Deployment Protection policies.
Deployment protection controls who can access a deployment after the request passes traffic-level security checks.
It is designed for:
- Preview deployments
- Branch deployments
- Pull request previews
- Unique deployment URLs
- Staged Production deployments that are not Current
Protection method
Easel provides workspace authentication (SSO through the Easel app host).
When deployment protection is enabled, visitors must sign in with a workspace
account before they can view protected deployment URLs. After a successful
sign-in, the edge sets a session cookie (easel_dp, about one hour).
Where to configure
- Open the project.
- Open Project settings.
- Find Deployment protection.
- Enable Require workspace sign-in.
- Save.
Allow a short CDN cache delay after toggling.
Security layers
Deployment protection is separate from the firewall.
A request may:
- Pass platform protections.
- Pass custom firewall rules and Attack Mode.
- Still be denied because the requester is not authorized to view the deployment.
Custom firewall actions do not bypass deployment authentication.
What is protected
When enabled, visitors need workspace sign-in for:
- Preview hostnames on
preview.easelusercontent.com(commit and branch URLs) - Any deployment that is not the current production release
The following stay public:
- The canonical production subdomain for the current production deployment
- LIVE custom domains on the current production deployment
Preview deployments
By default, preview hostnames are publicly reachable unless deployment protection is enabled.
Preview responses also send X-Robots-Tag: noindex, nofollow, noarchive so
crawlers skip indexing. noindex is not an access control.
See Preview deployments.
Forks and untrusted code
Treat Preview configuration as untrusted-input space:
- Keep Production secrets out of Preview variables
- Enable deployment protection when previews must not be public
See Secrets and Deployment environments.