Security

Control which outbound HTTP connections Inspire is allowed to make. This page lets you toggle specific categories of external access and maintain an allowlist of permitted hosts.

Navigate to Settings > Security.

Outbound HTTP Policy

Each toggle controls a category of outbound requests. Disabling a category blocks all HTTP calls in that category, regardless of the host allowlist.

Host Allowlist

The host allowlist restricts which external hosts Inspire can connect to. Enter one host per line.

Supported Formats

Default Allowlist

A fresh installation includes these default allowed hosts:

fonts.googleapis.com
fonts.gstatic.com
api.openai.com
ai.api.optymyse.com
*.blob.core.windows.net
licensing.api.optymyse.com

You can add or remove entries as needed. The allowlist is checked in addition to the category toggles — a request must pass both the toggle check and the host allowlist.

How Validation Works

When Inspire makes an outbound HTTP request:

1. The request category is checked against the toggles. If the category is disabled, the request is blocked.
2. The target host is checked against the allowlist. If the host is not in the list (and no wildcard matches), the request is blocked.
3. If both checks pass, the request proceeds.

This applies to all outbound HTTP made by the Edge server, including AI API calls, connector data fetches, webhook delivery, and license server communication.

Cookie Security

Controls authentication cookie behaviour including HTTPS enforcement, cross-site policy, and session timeouts.

HSTS (HTTP Strict Transport Security)

When enabled, the server sends a Strict-Transport-Security header instructing browsers to only connect via HTTPS for the specified duration.

Allowed Hosts

Restricts which Host header values each service accepts. This prevents host header injection attacks in deployments where services are exposed directly without a reverse proxy.

Separate multiple hosts with semicolons (e.g. inspire.example.com;admin.example.com). Set to * to allow any host — this is safe when running behind a reverse proxy (Traefik, nginx, Kamal) that validates the Host header.

Service-to-Service Authentication

Inspire uses an internal API key (InternalApiKey) for authentication between Edge, Renderer, and DataPool services.

Key Rotation

To rotate the internal API key without downtime:

1. Set the new key as INTERNAL_API_KEY and the old key as INTERNAL_API_KEY_PREVIOUS in all service environments.
2. Restart all services — they will accept both keys during the grace period.
3. Once all services are running with the new key, remove INTERNAL_API_KEY_PREVIOUS and restart.

DataPool Read Endpoints

All DataPool data read endpoints require the internal API key for authentication. Unauthenticated read requests are rejected with 401 Unauthorized. This ensures that only Edge and Renderer (which hold the internal API key) can query DataPool data, preventing direct unauthenticated access even on internal networks.

Endpoint Access Signing

Display and presenter access tokens can optionally use a dedicated signing key (EndpointAccessSigningKey) separate from the service authentication key. This limits blast radius — if the signing key is compromised, it cannot be used for service-to-service API access. Falls back to InternalApiKey when not set.

Device Pairing

Pairing codes are 8 characters from a 32-character unambiguous alphabet (no 0/O, 1/I/L), displayed as ABCD-EFGH. Codes expire after 15 minutes and are single-use. Device tokens are generated using cryptographically secure random bytes.

Proof of Play Integrity

Play event batches sent from Renderer to Edge are signed with HMAC-SHA256 using the internal API key. Edge verifies the signature before storing events, preventing forgery even if an attacker has network access to the internal API. Event timestamps are validated to be within 7 days of the current time (with 5 minutes of future tolerance for clock skew).

Account Security

Lockout thresholds and password complexity rules. Changes take effect immediately — ASP.NET Core Identity re-reads these options on every sign-in attempt and password change, so there is no restart banner.

Rate Limits

HTTP request rate limits for six distinct policies. Each policy is a sliding window partitioned by IP (for unauthenticated endpoints) or user ID (for authenticated endpoints).

Changes hot-reload for new partition keys. In-flight sliding windows keep their old limit until they expire (at most the window duration). Rate-limited endpoints return HTTP 429 Too Many Requests with a Retry-After header.

Data Retention

Controls how long proof of play data and audit history are kept before automatic cleanup. Both run weekly via background jobs.

At enterprise scale with 100+ endpoints rotating scenes every 30 seconds, the play events table grows approximately 288,000 rows per day. The weekly cleanup jobs delete old records in batches to avoid locking the database.

Audit Categories

Turn off categories of audit events you don’t want recorded. Disabled categories are not written to the AuditLog table or streamed to the webhook.

Audit Webhook

Stream audit events to an external SIEM or logging service. The delivery job runs every 10 seconds but only POSTs when enough time has passed since the last successful delivery, so the effective cadence is controlled by the Interval setting below.

Failed deliveries are retried on the next cycle — the cursor only advances on successful delivery, so no events are lost. The webhook receives events without RequestBody to avoid leaking sensitive data.

Sensitive Value Masking

Audit detail strings are passed through a defence-in-depth scrubber before they are written to the database or pushed to the webhook. The scrubber redacts common credential patterns even if they accidentally end up in a free-text detail field:

License keys are additionally masked to first 8 + last 4 characters (e.g. Key: ABCDEFGH…WXYZ). Audited request DTOs also pick safe properties at the source — only the listed fields ever reach the detail string in the first place.

Upload Limits

Controls how big an upload Inspire will accept. There are two layers: an application-layer limit enforced by FileUploadServices (hot-reload) and a transport-layer limit enforced by Kestrel (restart required — Kestrel captures its limit at startup).

Renderer Health Monitor

How aggressively Edge probes Renderer instances for health. Tighten for low-latency failover; relax for flaky networks where transient failures shouldn’t mark a node unhealthy.

Both hot-reload. Interval changes take effect on the next probe cycle; threshold changes take effect on the next failure.

MFA Enforcement (per tenant)

Configured via Settings > SSO, not this page. Each tenant has two flags that work together:

Saving Changes

A sticky bar appears when you have unsaved changes. Click Save Changes to apply or Discard to revert.