> For the complete documentation index, see [llms.txt](https://docs.apryse.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apryse.com/web/webviewer-server/wv-server-hardening.md). # Hardening WebViewer Server Improve WebViewer Server security with these container and file security measures. Learn how to isolate containers, restrict permissions, and enhance web security for a safer environment. The Apryse W This guide details how you can improve the overall security of WebViewer Server in your environemt. ### Container security In order to secure your container in your environment, we suggest you do the following. * Isolate the container from other servers and services * Only download the container from the Apryse repository * Do not run it on the same Docker network as other containers * Do not increase the privileges given to the containers * Use the most up to date version of Docker and WebViewer Server * Ensure your host system is up to date, this includes keeping your kernel version up to date * Do not mount sensitive host system directories onto the container * Do not add the ability to SSH into containers * [Limit memory and CPU](https://docs.docker.com/config/containers/resource_constraints/) usage to what you want to allow to the server container For more in depth and general purpose solutions to improving container security, please refer to this [guide](https://docs.docker.com/engine/security/). In addition to the to the innate security advantages of containerization, we have taken additional measures for this specific container: * Restricted permissions within the container on all systems * Restricted permissions on 3rd party libraries and executables * Blocked network access for 3rd party libraries * Configurable security options to improve WebViewer Server security ### File security WebViewer Server is designed to request files from a server. This means that between all clients and the file server, WebViewer Server can expose access to all files on the file server. The common way of dealing with this is to add security to your server. This can be done by: * Authentication gateway before accessing the server * Use signed links when retrieving files If you are concerned with clients still having access to files which they have lost access to we recommend enabling the [TRN\_FORCE\_URL\_RECHECK](/web/webviewer-server/wv-server-config.md#force-url-rechecking). This will force the file links to be rechecked for validity every time they are requested. ### Web Security We recommend reviewing our [security configuration options](/web/webviewer-server/wv-server-config.md#security-options) to improve web security. We recommend the following options be set within your system. * [INCLUDE\_DEMO](/web/webviewer-server/wv-server-config.md#include-demo) Set this to false to prevent vulnerabilities arising from the demo code packaged with WebViewer Server * [TRN\_ALLOWED\_ORIGINS](/web/webviewer-server/wv-server-config.md#restrict-client-origins) Set this to your Webviewer client domain to restrict requests to that domain. * [TRN\_FETCH\_REQUIRED\_ROOTS](/web/webviewer-server/wv-server-config.md#url-root-restriction) Set this to the root of your file server, which will restrict file requests to any other domain. * [Set up SSL for your containers](/web/webviewer-server/wv-server-hardware-and-network.md#https-setup) * Isolate your WebViewer Server from other servers on your network ### Caching Security If you have concerns with cached files being accessible if the link is given out, you can set the following options. Keep in mind these options will come with a loss in performance due to the loss of cache sharing. * [TRN\_ENABLE\_SESSION\_AUTH](/web/webviewer-server/wv-server-config.md#access-control) * [TRN\_ENABLE\_PER\_SESSION\_CACHING](/web/webviewer-server/wv-server-config.md#session-caching) * [TRN\_FORCE\_URL\_RECHECK](/web/webviewer-server/wv-server-config.md#force-url-rechecking) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.apryse.com/web/webviewer-server/wv-server-hardening.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.