Specify URL allow list for cross-origin iframe communication

  • 릴리스 버전: Australia
  • 업데이트 날짜 2026년 03월 12일
  • 소요 시간: 3분

    • Use a system property to specify which domains you trust for cross-origin communication.

    Use the glide.ui.concourse.onmessage_enforce_same_origin_whitelist property to enable cross-origin communication between iframes from trusted domains you specify in an inclusion list. This property specifies list of trusted origins for message propagation (sent via window.postMessage) in the UI. If this property isn't set to a list of trusted/allowed origins for cross domain messaging, then cross origin messages can be allowed from domains which contain malicious scripts. The property values should contain a list of origins should be separated by a comma. If the property value is empty then all domains are blocked.

    Ensure that the glide.ui.concourse.onmessage_enforce_same_origin_whitelist system property contains only a list of trusted domains to be used for cross origin messaging. If the list is empty no domains are allowed.

    More information

    Attribute Description
    Configuration name glide.ui.concourse.onmessage_enforce_same_origin_whitelist
    Configuration type System Properties (/sys_properties_list.do)
    Data type String
    Recommended value a comma separated list of trusted domains or empty
    Default value empty
    Fallback value empty
    Category Access control
    Security risk
    • Severity score: 4.2
    • CVSS score: Medium
    • Security risk details: Invalid trusted origins can allow untrusted domains to inject malicious payloads via window.postMessage, leading to cross-origin attacks such as data exfiltration, session hijacking, UI manipulation or DOM based XSS. If a web page contains event handlers that do not perform proper origin validation, a web page, or script from any origin, can communicate with it. It can also initiate any functionality performed by the event handler. Communication with iframes from other domains is a security risk.
    Functional impact If you don't add intended domains to the inclusion list, cross-origin messages from that domain are not allowed.
    Dependencies and prerequisites None