Static and Dynamic content URL - no subdomains

RE: Static and Dynamic content URL - no subdomains

Raj Kaladeen — Thu, 20 Apr 2023 22:24:12 GMT

As referenced in the public documentation in the blue box titled "Why do I need to register separate domains for these URLs?", browsers implement security controls between web content hosted in different domains. We recommend hosting third party content (either uploaded by users or enabled by component plugins) in separate top-level domains because it provides the most assurance that code introduced via one of these mechanisms cannot access unintended content in Appian, other systems in the same domain, or other third-party content.

For organizations that are unable to register independent top-level domains, we have an undocumented configuration (the one referenced in this comment) option that enables third party content to be hosted in subdomains. We recommend anyone considering use of this option familiarize themselves with the details of "same origin policy" and related topics such as "cross-site scripting attacks", and discuss the tradeoffs of allowing third party content in this manner with their security team.

RE: Static and Dynamic content URL - no subdomains

borise0001 — Thu, 30 Mar 2023 18:51:00 GMT

This parameter allows you to use the same TLD for the primary and dynamic/static URL.

Otherwise (w/o the parameter) Appian would expect 3 different TLDs because of security concerns.

Boris

RE: Static and Dynamic content URL - no subdomains

jjzemmouri — Thu, 30 Mar 2023 15:26:47 GMT

Hi,
I don't find any documentation explaining what this parameter exactly allows.

Could you give more details please ?

RE: Static and Dynamic content URL - no subdomains

dant0005 — Tue, 31 Jan 2023 11:55:39 GMT

This did the trick!

Thank you a lot.

Dan

RE: Static and Dynamic content URL - no subdomains

The Cloud Guy — Thu, 26 Jan 2023 18:52:54 GMT

You might also try adding this parameter to the custom.properties file...
conf.suite.DISABLE_SIBLING_DOMAIN_SECURITY=true