Overview
Seeq is designed to leverage the full web browser experience, but some use cases want to embed visualizations into dashboards or other web pages. This is typically done by using frames or iframes. However, embedding websites is often seen as a security risk due to click jacking. Seeq provides configuration options to control whether third-party web applications are able to render Seeq in an iframe.
The Network/Http/ContentSecurityPolicyFrameOptions and Network/Http/ContentSecurityPolicyFrameDomain settings work together to control whether Seeq can be embedded in an iframe. These options are listed below from least to most permissive.
Allow from Same Server (Default)
If the server hosting your dashboard or other frame is on the same server as Seeq, you can use SAMEORIGIN:
-
Set Network/Http/ContentSecurityPolicyFrameOptions to SAMEORIGIN
Allow from another domain
For embedding Seeq between hosts, you must provide the allowed domain. Wildcards are not allowed, and protocols must match (eg http vs https):
-
Set Network/Http/ContentSecurityPolicyFrameOptions to ALLOW-FROM
-
Set Network/Http/ContentSecurityPolicyFrameDomain to http://example.com (multiple comma-separated domains are allowed, except in Internet Explorer 11 which only uses the first domain)
Important notes
-
The Seeq server must be secure (i.e. https)
-
The Seeq server will need to be restarted for the changes to take effect.
-
Display of Seeq in a frame is not supported in Safari.
-
The Content-Security-Policy header and frame-ancestors directive is used to enforce the configured behavior settings.
The Network/Http/ContentSecurityPolicyFrameDomain is not configurable in Seeq. If you need to add or modify a frame domain, please create a support request.
See also:
MDN X-Frame-Options documentation
Combating ClickJacking With X-Frame-Options