This document provides corporate IT and Network Security administrators with the required configuration settings to enable uninterrupted access to the Architect Suite application (https://architect.erudition.design / https://architect-assessment.web.app).
If your organization enforces strict outbound firewall rules, web content filtering, SSL/TLS inspection, or IP restrictions, the application or its underlying backend services (Google Cloud and Firebase) may be blocked.
Please configure your firewall, proxy server, or content filter to allow outbound HTTPS (Port 443) traffic to the following domains and wildcard endpoints:
Primary Application Domains
architect.erudition.designarchitect-assessment.web.apparchitect-assessment.firebaseapp.com
Backend & Cloud Endpoints
*.cloudfunctions.netus-central1-architect-assessment.cloudfunctions.netus-central1-architect-scorm.cloudfunctions.net
Firebase & Google Cloud Services
*.firebaseapp.comidentitytoolkit.googleapis.comsecuretoken.googleapis.comfirestore.googleapis.com*.firebasestorage.appfirebasestorage.googleapis.com
Static Assets & CDNs (Required for Standard & Dynamic Cloud SCORM Packages)
cdn.tailwindcss.comfonts.googleapis.comfonts.gstatic.comwww.gstatic.comapis.google.comcdnjs.cloudflare.comcdn.jsdelivr.netunpkg.com
Note for Air-Gapped LMS Environments: SCORM packages exported in High-Security (Air-Gapped) mode bundle all framework libraries, fonts, and media assets inside the .zip archive and do not require external CDN or Cloud Function whitelisting.
-
✓
TCP Port 443 (HTTPS): Required for all secure API calls, Dynamic SCORM content delivery, and application rendering.
-
✓
TCP Port 80 (HTTP): Required solely for initial redirects to HTTPS.
-
✓
WebSockets (WSS over Port 443): Required for real-time database updates and active session sync.
If your corporate network uses SSL/TLS decryption or Deep Packet Inspection (DPI):
- Ensure that SSL decryption bypass is enabled for
architect.erudition.design, architect-assessment.web.app, *.cloudfunctions.net, and *.googleapis.com.
- Strict SSL inspection can break encrypted WebSocket connections, SCORM proxy handshakes, and Google Authentication handshakes.
Firebase Hosting and Google APIs utilize dynamically allocated IP addresses across Google's Global Edge Network. Whitelisting by specific IP address is not recommended.
If your firewall infrastructure strictly requires IP ranges rather than domain/FQDN whitelisting, you can import Google's officially published IP ranges:
