Protect Against Clickjacking With Trusted Domains

Overview

The Trusted Domains settings page lets you build a tenant-level allowlist of domains permitted to embed the Gainsight CS application and activate Content Security Policy (CSP) header enforcement with a single toggle. Once enabled, the browser blocks any domain not on the allowlist from embedding Gainsight CS in an iframe, protecting your customers against clickjacking attacks.

Salesforce, Zendesk, and Dynamics are automatically included in the trusted domains list so that Gainsight widgets continue to work across those platforms without any additional configuration.

Add Trusted Domains

Domains on the allowlist are permitted to embed the Gainsight application in an iframe. To include the domains as trusted domains in your instance:

1. Navigate to Administration > Security, and click the Trusted Domains tab.
   
   
    
2. Click Add Domain to add a URL as a trusted domain.
3. In the Domain text field, enter the domain URL. For example, *.abbett.com
4. Click Save to add the URL to the list of trusted domains. 
5. Turn on the Enable CSP Headers toggle. When enabled, only trusted domains can embed Gainsight pages in an iframe. All other domains are blocked.

Edit Domains

You can edit the domains as required. To edit an existing domain:

1. Navigate to Administration > Security, and click the Trusted Domains tab.
2. Click Edit next to the domain. The Domain textfield is enabled for changes.
3. Modify the domain as required, and click Save.

Delete Domains

You can delete any existing domain from the trusted list. To delete a domain:

1. Navigate to Administration > Security and click the Trusted Domains tab.
2. Click Delete next to the domain. The Domain is deleted from the list.