Appcelerator (DNS) Implementation: Security Considerations

For clients who want a plug-and-play solution, CrowdHandler's Appcelerator integration provisions a CDN in front of their origin using a DNS change. This allows all traffic to be routed through our application for queueing and access control. It also carries security implications that clients should understand before enabling it.

Isolated AWS resources

The CloudFront distribution and related resources for each Appcelerator domain are deployed within CrowdHandler's dedicated AWS account. Clients do not have direct access to configure these resources. Configuration is exposed through the CrowdHandler control panel (origin, behaviour rules, error handling and the no-bypass token).

Data visibility

Our Lambda@Edge functions call our API to route requests and responses. They only have access to request headers, not the request body or the origin response body. We have no visibility of sensitive data transmitted in bodies. Clients are unable to independently verify this because of the isolated AWS resources.

Use of encryption

All communication between end users, CloudFront and origin applications is encrypted in transit via TLS. The certificate for your domain is issued through AWS Certificate Manager during setup and renewed automatically as long as the validation DNS record stays in place.

No PAN data

Appcelerator does not support the transmission of cardholder data such as full card numbers. Any PAN data must be handled outside the scope of this feature so that CrowdHandler remains outside the client's cardholder data environment for PCI compliance.

Availability and failure behaviour

If the CrowdHandler API cannot be reached, the edge applies the Error Handling setting from the domain's Options panel. The default, Allow traffic through (fail open), lets visitors reach your origin unqueued. Send to waiting room (fail safe) holds visitors instead. Choose the behaviour that matches your risk appetite.

Shared responsibility

While we configure and manage CloudFront and Lambda@Edge, the client maintains responsibility for origin security and compliance. We recommend:

  • Enabling TLS at the origin and keeping certificates up to date.
  • Using the No-Bypass Token (the x-ch-no-bypass header with a shared secret) and rejecting requests at the origin that don't carry it, so that CrowdHandler cannot be bypassed by connecting to the origin directly.
  • Hardening infrastructure and enabling firewalls for only the necessary ports and protocols.

Appcelerator aims to provide simple access control and distribution for clients. It relies on proper security practices at the origin to safeguard sensitive data and meet compliance obligations. Clients should evaluate their use of this feature to determine controls and responsibilities for their unique needs.