Security settings

Security settings

For security purpose, most web browsers block cross-site scripting, cross-domain requests, and third-party cookies by default. Web browsers also have built-in security mechanisms such as same-origin and content security policies. These policies restrict how applications and scripts from one origin (domain) can interact with the resources hosted on another origin (domain).

Add trusted domains for embed supportπŸ”—

If you have embedded ThoughtSpot content within your application page using an inline frame, web browsers may block the embedded content. If your host application and embedded ThoughtSpot instance are on different domains, most web browsers also block cross-domain requests by default.

To enable seamless interaction between your host application and the embedded ThoughtSpot instance, you need to configure the following security settings in ThoughtSpot:

  • Trusted hosts for CORS

    To allow your application to call ThoughtSpot, access its resources, and render embedded content, you must add your domain as a trusted host and enable Cross-Origin Resource Sharing (CORS).

  • Trusted hosts for CSP

    To allow your application to embed ThoughtSpot and access its content via web browsers, add your application domain as a trusted host in the CSP allowlist. You need to also add the domain URLs to the connect-src allowlist to load script interfaces and allow Javascript events.

    Users with admin or developer privileges can configure the CORS and CSP allowlists on the Security Settings page in the Develop tab of the ThoughtSpot UI.

Add CSP visual embed hostsπŸ”—

To allow your host domain to set the frame-ancestors CSP policy header and embed a ThoughtSpot object within your application frame, add your application domain as a CSP visual embed host.

  1. Log in to your ThoughtSpot application instance.

  2. Click the Develop tab.

  3. Go to Customizations > Security settings.

  4. Click Edit.

  5. In the CSP visual embed hosts text box, add the domain names. For valid domain name formats, See Domain name format for CSP and CORS configuration.

  6. Click Save changes.

Add URLs to CSP connect-src allowlistπŸ”—

If you plan to create custom actions with URL targets, you must add the domain names of these URLs to the CSP connect-src allowlist. This allows JavaScript events triggered by the custom action URLs.

  1. Log in to your ThoughtSpot application instance.

  2. Click the Develop tab.

  3. Go to Customizations > Security settings.

  4. Click Edit.

  5. In the CSP connect-src domains text box, add the domain names. For valid domain name formats, See Domain name format for CSP and CORS configuration.

  6. Click Save changes.

Enable CORSπŸ”—

The CORS configuration for your cluster controls which domains can access and modify your application content. To allow your application to call ThoughtSpot or its REST API endpoints, and request resources, you must add your application domain to the CORS allowlist. For example, if your website is hosted on the example.com domain and the embedded ThoughtSpot content is hosted on the example.thoughtspot.com, you must add the example.com domain to the CORS allowlist for cross-domain communication. You can also add http://localhost:8080 to the CORS allowlist to test your deployments locally. However, we recommend that you disable localhost access in production environments.

If you enable CORS for your application domain, ThoughtSpot adds the Access-Control-Allow-Origin header in its API responses when your host application sends a request to ThoughtSpot.

To add domain names to the CORS allowlist, follow these steps:

  1. Log in to your ThoughtSpot application instance.

  2. Click the Develop tab.

  3. Under Customizations > Security settings.

  4. Click Edit.

  5. In the CORS whitelisted domains text box, add the domain names. For valid domain name formats, See Domain name format for CSP and CORS configuration.

  6. Click Save changes.

Add trusted domains for font, CSS, and image importπŸ”—

Starting from ThoughtSpot Cloud 8.10.0.cl release, you can add trusted source URLs from which images, fonts, and stylesheets can be retrieved.

  1. To define an allowed list of source URLs and domains, go to Develop > Customizations > Security Settings.

  2. Click Edit.

  3. In the CSP img-src domains field, add the domains from which you want to load images and favicons.

  4. In the CSP font-src domains field, add the domains from which you want to load fonts.

  5. In the CSP style-src domains field, add the domains from which you want to load stylesheets.

  6. Make sure the domain names are valid and listed as comma-separated values.

  7. Click Save changes.

Domain name format for CSP and CORS configurationπŸ”—

Important

Note the following points if using port or protocol in the domain name string:

  • The UI allows you to add a domain URL with or without the protocol (http/https) in the CSP allowlist. To avoid long URLs in the CSP header, we recommend that you don’t include the protocol in the domain name string. However, for non-HTTPS domains, such as your local testing environment, do include http in the domain name string.

  • Although you can add a domain URL with the protocol (http/https) to the CORS allowlist, ThoughtSpot ignores the protocol in the domain names of CORS hosts. Therefore, you can exclude the protocol in the domain name strings.

  • If your domain URL has a non-standard port such as 8080, specify the port number in the domain name string.

The following table shows the valid domain name strings for the CORS and CSP allowlists.

Domain name formatCSP Visual Embed hostCSP connect-srcCORSCSP font-src
CSP style-src
CSP img-src

Domain URL strings without protocol

  • thoughtspot.com

  • www.thoughtspot.com

βœ“ Supported

βœ“ Supported

βœ“ Supported

βœ“ Supported

Domain URL strings for localhost

  • localhost

  • localhost:3000

  • http://localhost:3000

βœ“ Supported

βœ“ Supported

βœ“ Supported

βœ“ Supported

Domain URL strings without port

  • thoughtspot.com

  • mysite.com

If your domain URL has a non-standard port, for example mysite.com:8080, make sure you add the port number in the domain name string.

βœ“ Supported

βœ“ Supported

βœ“ Supported

βœ“ Supported

Wildcard (*) for domain URL

βœ“ Supported

βœ“ Supported

x Not supported

βœ“ Supported

Wildcard (*) before the domain name extension
https://*.com

x Not supported

x Not supported

x Not supported

x Not supported

Plain text string without the domain name extension.

thoughtspot

x Not supported

x Not supported

x Not supported

x Not supported

Domain name with wildcard (*) and a leading dot

.*.thoughtspot.com

x Not supported

x Not supported

βœ“ Supported

To avoid domain validation errors, make sure you add an escape character \ after the wildcard in the domain URL string:
.*\.thoughtspot.com

x Not supported

Wildcard before the domain name

*.thoughtspot.com

βœ“ Supported

βœ“ Supported

x Not supported

βœ“ Supported

Domain names with space, backslash (\), and wildcard (*).

  • www.*.*.thoughtspot.com

  • www.thoughtspot.com/*

  • thoughtspot .com

x Not supported

x Not supported

x Not supported

x Not supported

URLs with query parameters
http://thoughtspot.com?2rjl6

x Not supported

x Not supported

x Not supported

x Not supported

URLs with path parameters
thoughtspot.com/products

βœ“ Supported

βœ“ Supported

x Not supported

βœ“ Supported

URLs with path and query parameters
thoughtspot.com/products?id=1&page=2

x Not supported

x Not supported

x Not supported

x Not supported

IPv4 addresses
255.255.255.255

βœ“ Supported

βœ“ Supported

βœ“ Supported

βœ“ Supported

Semicolons as separators
thoughtspot.com; thoughtspot.com;

x Not supported

x Not supported

x Not supported

x Not supported

Comma-separated values
thoughtspot.com, thoughtspot.com

βœ“ Supported

βœ“ Supported

βœ“ Supported

βœ“ Supported

mail://xyz.com

x Not supported

x Not supported

x Not supported

x Not supported

Wildcard (*) for port

thoughtspot:*

βœ“ Supported

βœ“ Supported

βœ“ Supported

βœ“ Supported

Block access to non-embedded ThoughtSpot pagesπŸ”—

If you have embedded ThoughtSpot content in your app, you may want your users to access only the ThoughtSpot pages embedded within the context of your host app.

If you have embedded ThoughtSpot using Visual Embed SDK v1.22.0 or later, the blockNonEmbedFullAppAccess property in the SDK is set to true by default. Due to this, your application users cannot access or navigate to the ThoughtSpot application experience outside the context of your app.

If you are not using Visual Embed SDK to embed ThoughtSpot, you can turn on the Block non-embed full app access feature on the Develop > Customizations > Security Settings page. This will restrict your users from opening non-embedded ThoughtSpot pages from their embedded app context. Note that this feature does not restrict ThoughtSpot users with administrator or developer privileges from accessing ThoughtSpot pages.