Applications may embed Medallia Web reporting within the application to make it easy for the user to access reports. For example, see Embedding Medallia Web in Salesforce. This functionality is accomplished using the HTML <iframe> element to embed a web page in another web page.

Here's an example of a simple web (HTML) page with a iframe that opens a Medallia Web reporting instance. 

The <iframe> statement must include both src and referrerpolicy attributes. Other attributes, such as scrolling, may be included an needed.

<iframe src="src-uri" referrerpolicy="policy" ... />

• src identifies the Medallia Web reporting instance to load. If the company is using Single sign-on (SSO), the URL may point to a specific page (a deep-link), in which case the frame shows the identified report available to the user's default role. For example, to open the dashboard home:

  <iframe src="https://example.medallia.com/company/homepage.do" ... />

• referrerpolicy controls how much referrer information (sent via the Referer header) should be included with requests. For a description of the policy options, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy. Any policy option is acceptable except 'no-referrer', because that prevents framing.

Many company web servers are configured to block embedding of external websites in their own web pages. To tell the web site it is OK to embed Medallia Web reporting, add these domains to the Integrations > Data Exports > App Embedding Allow-lists screen:

medallia.com
force.com
salesforce.com
[SSO IDP PROVIDER]

For more information, see App embedding Allow-lists.