Restricting access to runtimes

[mkdish]

Hi, for my project I have created 4 runtimes - dev, qa, stage & prod. 

When I publish the app in all the runtimes - it gets available globally on www. 

How can I restrict this at org level - where in users outside my org should not be able to access dev, qa & stage. 

Example - 

https://12345-mywebsite-dev.adobeio-static.net - should be blocked 

[SarahXu]

Hi @mkdish 

When you publish your application to make it available for users within your org -- they would only be able to see the production application. https://developer.adobe.com/app-builder/docs/getting_started/publish_app/

However, if your app is a headless application, all you need to do is to not share the URL of your dev / qa / stage actions with the users and only share the production url with them. Hope that helps!

[mkdish]

Thanks Sarah. Yes we have headless react app deployed on APP builder runtime. Will there be any security issues with exposing lower runtimes? 

[SarahXu]

You should always protect your application so that not everyone could access it. This might be a good start to help you secure it! https://developer.adobe.com/app-builder/docs/guides/security/