Security & Hardening

Secure Elsa hosts, workflow ingress, bookmark resume URLs, and Studio deployments with focused production hardening guidance.

This section covers the security controls around an Elsa deployment: how traffic reaches it, how workflow callbacks are protected, how sensitive values are handled, and how to operate the deployment safely in production.

Authentication and authorization answer a different question: who may call Elsa and what may they do? For Elsa Identity, API keys, OpenID Connect, permissions, and External Authentication, start with Authentication & Authorization.

Security Guides

Guide	Use it when you need to...
HTTP Endpoint Security	Protect workflow routes created by the HttpEndpoint activity, including public endpoints and ASP.NET Core policies.
Elsa API Rate Limiting	Apply a named ASP.NET Core rate-limiting policy to the routed Elsa API without changing workflow-ingress limits.
Bookmark Resume Tokens	Send or receive tokenized callback URLs that resume waiting workflows.
Public Trigger Tokens	Operate protected event-trigger URLs and keep Data Protection keys continuous across nodes.
Production Hardening	Configure browser boundaries, ingress, TLS, Studio deployment, monitoring, and operational checks.
Secrets Management	Store and resolve named values from workflows and Elsa modules.

Scope and Boundaries

Security controls complement authentication; they do not replace it.

• Secure workflow ingress separately from Elsa API access. A public HttpEndpoint does not make the Elsa API public, and Elsa API permissions do not automatically protect a workflow route. See HTTP endpoint security.

• Treat a bookmark resume URL as a bearer capability. Give it an appropriate lifetime, do not log its token, and apply controls appropriate to the callback's risk. See Bookmark resume tokens.

• Treat public event-trigger URLs as bearer capabilities as well. Use the public trigger token guide for the shared token service, authenticated alternative, and multi-node Data Protection setup.

• Keep host and infrastructure secrets outside source control. For values that workflows must resolve, use the Secrets management module and protect its encryption key.

• Apply network, transport, browser, and deployment controls before exposing Elsa or Studio to untrusted networks. See Production hardening.

Related documentation

• Authentication & Authorization

• Permissions reference

• Direct OpenID Connect

• External Authentication

• Clustering

• Monitoring & Observability