| Domain name format | CSP Visual Embed host | CSP connect-src | CORS | CSP font-src CSP style-src CSP img-src |
|---|---|---|---|---|
Domain URL strings without protocol
| ✓ Supported | ✓ Supported | ✓ Supported | ✓ Supported |
Domain URL strings for localhost
| ✓ Supported | ✓ Supported | ✓ Supported | ✓ Supported |
Domain URL strings without port
If your domain URL has a non-standard port, for example | ✓ Supported | ✓ Supported | ✓ Supported | ✓ Supported |
Wildcard ( | ✓ Supported | ✓ Supported | x Not supported | ✓ Supported |
Wildcard (*) before the domain name extension | x Not supported | x Not supported | x Not supported | x Not supported |
Plain text string without the domain name extension.
| x Not supported | x Not supported | x Not supported | x Not supported |
Domain name with wildcard (*) and a leading dot
| x Not supported | x Not supported | ✓ Supported To avoid domain validation errors, make sure you add an escape character | x Not supported |
Wildcard before the domain name
| ✓ Supported | ✓ Supported | x Not supported | ✓ Supported |
Domain names with space, backslash (\), and wildcard (*).
| x Not supported | x Not supported | x Not supported | x Not supported |
URLs with query parameters | x Not supported | x Not supported | x Not supported | x Not supported |
URLs with path parameters | ✓ Supported | ✓ Supported | x Not supported | ✓ Supported |
URLs with path and query parameters | x Not supported | x Not supported | x Not supported | x Not supported |
IPv4 addresses | ✓ Supported | ✓ Supported | ✓ Supported | ✓ Supported |
Semicolons as separators | x Not supported | x Not supported | x Not supported | x Not supported |
Comma-separated values | ✓ Supported | ✓ Supported | ✓ Supported | ✓ Supported |
| x Not supported | x Not supported | x Not supported | x Not supported |
Wildcard (*) for port
| ✓ Supported | ✓ Supported | ✓ Supported | ✓ Supported |
Security settings
The Security Settings page in ThoughtSpot UI allows administrators and developers to configure Content Security Policy (CSP), Cross-origin resource sharing (CORS), authentication, and access control settings.
|
Note
|
The following settings on the Security Settings page appear as locked for ThoughtSpot Analytics application users. These settings apply to ThoughtSpot embedding and require an embedding license: |
Security settings for ThoughtSpot embedding🔗
Most web browsers block cross-site scripting, cross-domain requests, and third-party cookies by default. Web browsers also have built-in security mechanisms like same-origin and content security policies. These policies restrict how applications and scripts from one origin (domain) can interact with the resources hosted on another origin (domain). For embedded content and data security and to provide a seamless user experience, configure the settings described in this section.
Third-party cookies🔗
When ThoughtSpot is embedded in another application, it is considered a third-party application in the host application context. As a result, cookies from ThoughtSpot are blocked by Web browsers.
To avoid this issue, ThoughtSpot recommends the following:
-
Use cookieless authentication in your production environments. Developers can use either
AuthType.EmbeddedSSOorAuthType.TrustedAuthTokenCookielessbased on their embedding setup. -
If you are using a ThoughtSpot Cloud instance, set up your instance to the same domain as your host application. For more information, see Custom domain configuration.
-
If you are using authentication methods that rely on cookies, enable partition cookies.
Add domains to CSP and CORS allowlists🔗
To allow another application to embed ThoughtSpot, you must add your host application domain as a CSP Visual Embed host.
To allow your embedding application to call ThoughtSpot, access its resources, and render embedded content, add your host application domain URL as a trusted host for CORS.
To allow loading script interfaces and JavaScript events for custom actions, or to enable importing resources from other sites, add the source domain URLs as trusted hosts in the respective CSP allowlist.
Add CSP visual embed hosts🔗
To allow your host domain to set the frame-ancestors CSP policy header and embed a ThoughtSpot object within your application frame, add your application domain as a CSP visual embed host.
-
On your ThoughtSpot application instance, go to Develop > Customizations > Security settings.
-
Click Edit.
-
In the CSP visual embed hosts text box, add the domain names. For valid domain name formats, See Domain name format for CSP and CORS configuration.
-
Click Save changes.
|
Note
|
Only users with a valid embed license can add Visual Embed hosts. |
Add URLs to CSP connect-src allowlist🔗
If you plan to create custom actions with URL targets, you must add the domain names of these URLs to the CSP connect-src allowlist. This allows JavaScript events triggered by the custom action URLs.
-
On your ThoughtSpot application instance, go to Develop > Customizations > Security settings.
-
Click Edit.
-
In the CSP connect-src domains text box, add the domain names. For valid domain name formats, See Domain name format for CSP and CORS configuration.
-
Click Save changes.
Add other trusted domains🔗
To import images, fonts, and stylesheets from external sites, or load the content from an external site using an iFrame element, you must add the source URLs as trusted domains in the CSP allowlist. For example, in the Liveboard Note tiles, if you want to insert an image from an external site or embed content from an external site in an iFrame, you must add domain URLs of these sites to the CSP allowList. Similarly, to import fonts and custom styles from an external source, you must add the source URL as a trusted domain in ThoughtSpot.
The following CSP settings are available on the Develop > Customizations > Security Settings page:
-
CSP img-src domains
Add the domains from which you want to load images and favicons. -
CSP font-src domains
Add the domains from which you want to load fonts. -
CSP style-src domains
Add the domains from which you want to load stylesheets. -
CSP frame-src domains
Add the iframe source URL domains. -
CSP script-src domains Add the domains from which you want host scripts. For more information, see Integrate third-party tools and allow custom scripts.
|
Note
|
If your application instance has Orgs, the CSP settings can be configured only at the cluster level. |
Enable CORS🔗
The CORS configuration for your cluster controls which domains can access and modify your application content. To allow your application to call ThoughtSpot or its REST API endpoints, and request resources, you must add your application domain to the CORS allowlist. For example, if your website is hosted on the example.com domain and the embedded ThoughtSpot content is hosted on the example.thoughtspot.com, you must add the example.com domain to the CORS allowlist for cross-domain communication. You can also add http://localhost:8080 to the CORS allowlist to test your deployments locally. However, we recommend that you disable localhost access in production environments.
If you enable CORS for your application domain, ThoughtSpot adds the Access-Control-Allow-Origin header in its API responses when your host application sends a request to ThoughtSpot.
To add domain names to the CORS allowlist, follow these steps:
-
On your ThoughtSpot application instance, go to Develop > Customizations > Security settings.
-
Click Edit.
-
In the CORS whitelisted domains text box, add the domain names. For valid domain name formats, See Domain name format for CSP and CORS configuration.
-
Click Save changes.
Domain name format for CSP and CORS configuration🔗
|
Important
|
|
The following table shows the valid domain name strings for the CORS and CSP allowlists.
Block access to non-embedded ThoughtSpot pages🔗
If you have embedded ThoughtSpot content in your app, you may want your users to access only the ThoughtSpot pages embedded within the context of your host app. ThoughtSpot allows administrators to restrict user access to non-embedded application pages from the embedding application context or selectively grant access to specific user groups. For information, see Control User Access.
Enable partitioned cookies🔗
Many web browsers do not allow third-party cookies. If you are using authentication methods that rely on cookies, users will not be able to access the embedded content when browsers block third-party cookies. Therefore, ThoughtSpot recommends using cookieless authentication in production environments.
However, if your implementation uses cookie-based authentication or AuthType.None, ensure that you enable partitioned cookies:
-
On your ThoughtSpot application instance, go to Develop > Customizations > Security settings.
-
Click Edit.
-
Turn on the Enable partitioned cookies toggle switch.
-
Click Save changes.
With partitioned cookies enabled, when a user logs in to ThoughtSpot and accesses embedded content on a host application, a cookie is set with the partitioned attribute. On browsers supporting partitioned cookies, the partitioned cookie will persist in the app after a successful login.
|
Important
|
Safari blocks all third-party cookies and does not support partitioned cookies. You can switch to a different browser that supports partitioned cookies, or use cookieless authentication in your embedding implementation. |
Add permitted iFrame domains🔗
Some features in ThoughtSpot, such as Liveboard Note tiles and custom charts, allow iFrame content. If you are planning to embed content from an external site, make sure the domain URLs of these sites are added to the iFrame domain allowlist:
-
On your ThoughtSpot application instance, go to Develop > Customizations > Security settings.
-
Click Edit.
-
In the Permitted iFrame domains text box, add the domain URL of the website or portal that you want to use for iFrame content.
-
Click Save changes.