topic Re: Blocking end-users from seeing application until after login in ArcGIS Experience Builder Questions

Blocking end-users from seeing application until after login

ericsamson_tract — Mon, 07 Oct 2024 17:12:48 GMT

Hey all,

I have created several experience builder applications using the developer version. These have a lot of custom widgets that I would prefer the public to not be able to view. My application is hosted and currently accessible from anyone with access to the URL. They can't see any of the data, since they need to be logged into our org to see all the good stuff.

However, as of right now, the application will load all aspects of the application except for the data, allowing anyone to see things like the custom widgets (although they won't run) and our custom layer lists (which does list what data we use).

While I understand that anyone could simply right click and dig into the source code for these if they wanted to, I was wondering if anyone has had any luck displaying a blank screen until authentication has been completed? Or have any ideas how I would implement that

Web appbuilder developer edition does this by default when deployed, it's frustrating that experience builder doesn't out of the box.

Thanks,

Re: Blocking end-users from seeing application until after login

Wei_Ying — Fri, 11 Oct 2024 01:25:13 GMT

Hi @ericsamson_tract ,

Thanks for your feedback! Since you deploy the app on your own server, instead of ArcGIS platform, so we cannot simply use the auth process from ArcGIS.

You may try to set up a credential requirement for your server, so when user accessing your server, they need a credential when visiting the URL.
So far there is no easy way to do from ExB. Otherwise, you may customize a landing page with customized login widget to ask user for credential, where after user logged in redirect them to the true app.
We are actually working on a Login widget, which might help solve your case in future.

Thanks,
Wei

Re: Blocking end-users from seeing application until after login

ericsamson_tract — Fri, 15 Nov 2024 21:56:05 GMT

In case anyone else finds this, I was able to figure it out. My solution involves simply blocking the following css classes if the user is not authenticated:

'controller-container' and 'widget-content'

Of course people can work around this if they really want to, so take it with a grain of salt. It works for my purposes. I wrote the following code and put it within the index.html file:

Re: Blocking end-users from seeing application until after login

Nadia_Matsiuk — Thu, 20 Feb 2025 11:07:50 GMT

Hi, @Wei_Ying !
Are there any updates on this?

This widget is very relevant for our team.🙏

Currently, we are considering developing our own widget that will check which user logs in and filter the interface data accordingly (using data_filter).
Is this a good solution in terms of web security?

There is my open issue: https://community.esri.com/t5/arcgis-enterprise-questions/how-to-display-different-data-per-user-in-an/m-p/1585984

Thanks!

Re: Blocking end-users from seeing application until after login

Wei_Ying — Thu, 27 Mar 2025 20:54:15 GMT

It is on our roadmap to filter user group for resource accessing. It may come in 2026.

Re: Blocking end-users from seeing application until after login

ericsamson_tract — Thu, 28 Aug 2025 22:48:42 GMT

Hey @Wei_Ying wanted to follow up on this. Any updates on the login widget you mentioned?

Re: Blocking end-users from seeing application until after login

Wei_Ying — Tue, 18 Nov 2025 19:22:05 GMT

The login widget has been supported on October 2025 release.

Re: Blocking end-users from seeing application until after login

ericsamson_tract — Thu, 04 Dec 2025 17:59:48 GMT

Great news, thank you @Wei_Ying

I am trying to figure out how to use this widget to accomplish the above. Are there any examples or demos available for this widget yet? I am having trouble figuring out the functionality