no way to secure exported developer edition of Experience Builder?

KeithFraley1

we are tying to develop our own experience builder app using the export function developer edition.  We are finding that there is no way to secure the experience itself with esri authentication.  

Highlevel Summary:

• create dev edition ExB
• export to zip ExB app
• load onto local webserver
• Navigate to URL of ExB
• Without being logged into my org I can still see static config of the ExB (things like images, titles, text summaries)
• User does get prompted to login to see secure features (webmap, datagrid...) however a user that is not authenticated can still see status part of the ExB

Are we right to assume this is by design?  This seems like a major security concern and makes using ExB developer edition in any type of production sense highly unlikely.

 

Are we missing something?

Kishore

@KeithFraley1  - The end exported product from EXB app is in simple HTML, JS and CSS files. You can secure the access of your web server to achieve what you want. In my case, we use IIS as web server. hence, we enabled windows authentication and disabled all other methods. Please remember if you enable windows authentication your ArcGIS enterprise must have Single-sign on enabled and also all users must be from your Active directory. Hope this helps you.