Table of Contents
CSP, CORS, and User Interface integrations
09. February 2026
Table of Contents
Cross-site scripting protection mechanisms in browsers are made to protect users against malicious code when embedding content and scripts from external sources (as in external domain names). As most integrations will be hosted on a separate domain, such mechanisms often take effect.
Note
We strongly discourage building integrations that rely on browser extensions which override, modify, or disable Content Security Policy (CSP), as this can expose users to significant security risks.
CSP in Fotoware
CSP (Content Security Policy) is a security mechanism that controls the sources from which external content can be loaded into an HTML page. Typically, it should be configured so that content can only be loaded from specific trusted sources, ideally only from the same domain as the page. Fotoware also has strict CSP rules that allow embedding only content from the same domain and specific additional domains.
When registering a user interface integration with Fotoware, the domain portion of the integration's URL is automatically added to Fotoware's CSP rules.
The integration might not work if it redirects to pages hosted on other domains.
If a third-party website used in a UII redirects to a different domain, then the destination domain may be blocked by CSP. As a remedy, use the final URL in the UII configuration, so it is allowed by CSP.
Note
CSP in Fotoware does NOT automatically protect the integration from cross-site scripting (XSS) attacks or insertion of malicious content via UII URL parameters containing user input, such as asset metadata values.
- Always carefully construct URL patterns for UIIs to secure the integration against XSS.
- Validate all data that is received via the URL in the UII.
- Enable CSP within the UII, if possible, but do not rely that the user's browser supports UII (all modern browsers support UII by default). If possible, disable inline JavaScript and JavaScript URLs.
- NEVER directly redirect to a full URL taken from a metadata field.
CSP in the Integration
A website embedded as a UII may also prevent Fotoware from embedding it, making it unsuitable as a UII. This is a problem specifically when trying to embed third-party websites that the integrator does not control, such as Google Maps or Wikipedia.
- When building a bespoke integration that is to be embedded as a UII, make sure that the
frame-ancestorsCSP directive of the integration does not prevent such embedding by either not using this directive, setting it to*to allow embedding in all domains, or setting it to explicitly allow embedding into Fotoware (requires that the domain of the Fotoware site is known). - When embedding a third-party website as a UII, be aware that it may have a content security policy that prevents embedding in Fotoware or may prevent embedding altogether. Google Maps and YouTube are known examples of websites that prevent embedding of the main websites (but do support embedding via special embedding URIs). For more information, consult the documentation of any external websites or web applications you would like to embed.
Embedding third-party websites may require paid subscriptions, and some may display ads or track users (with privacy implications). Even if a third-party website does not prevent embedding via CSP, this can change at any time and without warning, so your UII may stop functioning at any time.
Note
CSP rules in Fotoware have a long cache time, meaning newly registered UIIs may not work for some time. Deleting the browser cache does not help in this instance.
CORS in Fotoware
A user interface integration can use the API to access resources in Fotoware. If the integration has a back-end (server), then the back-end can generally make such API requests. However, making requests to the Fotoware API directly from the front-end (the web browser) requires Cross-Origin Resource Sharing (CORS) to be enabled.
- In Fotoware Veloz, CORS can be enabled for the domain of a user interface integration by enabling the Enable CORS option in the application registration.
- In Fotoware On-premises, see Enabling CORS.
A UII is usually loaded from a different origin domain than the Fotoware site. Therefore, it is not possible to make API requests to Fotoware directly from JavaScript due to the browser's same-origin policy. To make API requests from a UII, the following options exist:
- Make API requests from a back-end: If the UII is supported by a back-end server on the origin domain it is loaded from, then it can make direct requests to this back-end, which can, in turn, make API requests to Fotoware.
- Enable CORS: By enabling cross-origin resource sharing on the Fotoware site, the UII's origin domain can make API requests directly to Fotoware from JavaScript.