Origin Protection
Origin Protection makes a Quant Cloud container accept traffic only through a Quant CDN or proxy project. When it is on, a direct request to the application’s origin or preview domain is blocked. Visitors must come through your project, so they always pass its password rules, WAF, bot challenge and other rules.
Turn it on for every container that exposes a port, in every environment.
Turn on Origin Protection
Section titled “Turn on Origin Protection”- In the dashboard, open Cloud Apps and select the application.
- Select the environment, then open the Details tab.
- Select Edit config.
- Find the container, and turn on Enable origin protection.
- Save, and repeat for each environment of the application.
The Containers tab of the environment shows the current setting for each container.
Options
Section titled “Options”| Setting | Description |
|---|---|
| Enable origin protection | Blocks direct access through the origin or preview domain. Access must go through a Quant CDN or proxy project. |
| Redirect denied requests (optional) | A bare host, for example www.example.com. A blocked request gets a 302 redirect to this host, with the path and query kept, instead of a 403. Allowed IPs and CDN traffic are not affected. |
| IP allow list (optional) | IP addresses or CIDR ranges that can still reach the origin directly, for example your office or VPN for testing. Keep this list short. |
Origin Protection is set per container in the application’s container definition:
| Field | Type | Description |
|---|---|---|
originProtection |
boolean | Turns Origin Protection on for all exposed ports of the container. |
originProtectionConfig.enabled |
boolean | Same setting, in the extended form. Defaults to true when the object is present. |
originProtectionConfig.ipAllow |
array of strings | IP addresses or CIDR ranges that can bypass Origin Protection. |
originProtectionConfig.redirectHost |
string | Optional host to redirect denied requests to, instead of returning a 403. |
Check that it works
Section titled “Check that it works”After you save, test both paths:
- Open the site through its public domain. It must load as before.
- Request the application’s origin or preview domain directly. It must return a 403, or redirect to the host you set.