Additional dashboard configuration

Hosting AIM in an IFrame

When the AIM application is embedded within another web application using an <iframe>, additional configuration may be required to allow communication between the hosting application and AIM.

Cross-Origin Resource Sharing (CORS)

If the hosting application and AIM are served from different origins (for example, different ports, domains, or protocols), configure CORS on the AIM server to allow requests from the hosting application's origin.

Example:

<Cors>

<AllowOrigins Value="https://<host-application-origin>" />

<AllowHeaders Value="Accept,Authorization,Content-Type" />

<AllowMethods Value="GET,POST" />

<AllowCredentials Value="true" />

</Cors>

Replace <host-application-origin> with the origin of the application that hosts the AIM iframe.

Content security policy (CSP)

To allow AIM to be embedded within an iframe hosted by another application, add the hosting application's origin to the frame-ancestors directive in the Content Security Policy (CSP) configuration.

<add source="https://<host-application-origin>" />

Add this entry under the frame-ancestors configuration in web.config.

Example

• Host application URL: https://host-app.com

• AIM URL: https://aim-server.com

The host application embeds the AIM URL in an iframe. In this case:

• The AIM server must allow the host application's origin in its CORS configuration.

• The host application's origin must be added to the frame-ancestors CSP configuration so that the AIM application can be rendered inside the iframe.

These settings help prevent browser security restrictions related to cross-origin requests (CORS) and iframe embedding (CSP).