Abstract: Embodiments are directed to access control on curated content items of user groups in a cloud-based collaboration environment. Managing permissions in a cloud-based collaboration environment can comprise creating an application object in the cloud-based collaboration environment. The application object can comprise an object accessible only through an associated application. One or more users of the application object can be added to the application object and permissions for accessing the application object can be defined for the users. One or more content items of content items stored in a repository maintained by the collaboration server can be added to the application object and permissions for accessing the content items can be defined for the users. The permissions for accessing the application object for the users can be independent of the permissions for accessing the content items for the users.

Abstract: Embodiments of the disclosure provide systems and methods for curating access-only content items of user groups in a cloud-based collaboration environment by creating a content hub in the cloud-based collaboration environment. The content hub can comprise a logical representation of a collection of content items stored in a repository. The content hub can be populated with hub information defining the content hub and selected content items of the content items stored in the repository can be added to the content hub. The content hub can then be published in the cloud-based collaboration environment with the selected content items added to the content hub being available for access only to one or more users.

Abstract: Techniques are described for separating subdomains as part of a secure login process. For example the subdomains can correspond to an enterprise user or personal user accounts, or both. The login process involves responding to a login request with an assertion, such as for example a redirect based assertion, that includes an encrypted data structure with account and user information necessary for identification of the corresponding subdomain. The encrypted data structure includes browser-, IP address, and user-specific information to thwart a cross-site request forgery (CSRF) security vulnerability, among other things.

Abstract: Techniques are described for separating subdomains as part of a secure login process. For example the subdomains can correspond to an enterprise user or personal user accounts, or both. The login process involves responding to a login request with an assertion, such as for example a redirect based assertion, that includes an encrypted data structure with account and user information necessary for identification of the corresponding subdomain. The encrypted data structure includes browser-, IP address, and user-specific information to thwart a cross-site request forgery (CSRF) security vulnerability, among other things.