App embedding Allow-lists

Integrations > Data Exports > App Embedding Allow-lists

An app embedding allow-list identifies website domains that may render a Medallia Web reporting page in a frame on another application's web page. Business web servers typically employ security measures that tell the browser to block the display of external pages unless the page includes specific directions to identifying the company's domain as one that may embed the pages. When the pages are blocked, the frame appears empty.

Deny embedding by default

By default, Medallia Experience Cloud denies all other applications from embedding Medallia Web reporting in a frame. This happens when either:

there is no allow-list defined.
the request to Medallia Web reporting omits the Referer header (which tells the system who is actually making the request).
the header is a domain not in the domains list

In any of those conditions the response includes this header in the HTTP response:

X-Frame-Options: deny

Allow lists

For each domain that may embed a Medallia Web reporting page, add it (one per line) and include the HTTP scheme (e.g., https://) like this:

https://medallia.com
https://force.com
https://salesforce.com
[SSO IDP PROVIDER URL]

Important: When the company is using single sign-on, include the IdP provider in the list ([SSO IDP PROVIDER URL]). See Single sign-on (SSO) for information about IdP.

Including an asterisk (*) on a line by itself in the domain list allows all domains to embed Medallia Web reporting screens. Use this option with caution, preferably only for testing purposes.

Policy directives

Medallia Experience Cloud sends one policy directive for each entry in the allow-list. There are two types of policy directives; you must pick one; you cannot use both. The Enable Content-Security-Policy frame-ancestors header option identifies which to use.

The two types of directives are:

Content Security Policy frame-ancestors (CSP Header)
- allows page embedding in an <frame>, <iframe>, <object>, <embed>, or <applet> element
- sent when the Enable Content-Security-Policy frame-ancestors header is on
- not supported by Internet Explorer, except for Internet Explorer 10 only
- example header response to allow the salesforce.com domain to embed Medallia Web reporting in frames:
```
Content Security Policy: frame-ancestors https://salesforce.com
```
X-Frame Options (XFO Header)
- allows page embedding in an <frame>, <iframe>, or <object> HTML element
- sent when the Enable Content-Security-Policy frame-ancestors header is off
- supported by Internet Explorer
- example header response to allow the salesforce.com domain to embed Medallia Web reporting in frames:
```
X-Frame-Options: ALLOW-FROM salesforce.com
```

Important: Use CSP Header unless your instance needs to support obsolete Internet Explorer browsers.