---
title: "The two-origin security boundary"
description: "Why the trusted Artifact Server application and untrusted artifact content use separate origins."
---

> Documentation Index
> Fetch the complete documentation index at: https://artifactserver.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The two-origin security boundary

Artifact Server displays HTML artifacts on a large canvas. Published HTML cannot access the trusted application session.

## Trusted application origin

The application origin owns:

- browser authentication and membership
- projects, artifact metadata, versions, and manifests
- comments, sharing, access changes, and administrative actions
- the review interface and its controls

## Isolated content origin

Each exact artifact version uses an isolated content hostname. Content-session cookies apply only to the content host. Exact-version browser access uses single-use bootstraps. The trusted application embeds review content through a separate sandboxed frame.

```text
app.example.com                      trusted application
version-token.content.example.com    isolated artifact bytes
```

The boundary lets artifacts use their own scripts, styles, images, fonts, and media without inheriting the trusted Artifact Server application's credentials or network authority.

> **Full screen does not remove isolation**
>
> Focus mode changes layout, not trust. The artifact receives more screen area while the content origin and sandbox boundary stay intact.

Source: https://artifactserver.com/docs/concepts/security-boundary/index.mdx