Task 1: Allow Your Websites to Appear in the SAS Customer Intelligence 360 User Interface

To prevent clickjacking and other malicious and inappropriate use of their websites, companies commonly use web servers that deny outside sources the ability to display their content inside an unknown inline frame (iframe). Because SAS Customer Intelligence 360 uses iframes to provide a point-and-click interface that identifies spots and elements on your website, any iframe restrictions must be modified to allow the SAS domain to display your website in an iframe.

If your website does not open in the user interface for SAS Customer Intelligence 360, use one of these methods to resolve the issue (depending on the existing settings for your web server):

• In the HTTP header, configure the X-Frame-Option parameter so that the ALLOW-FROM directive includes the user-interface address for SAS Customer Intelligence 360. (Maintain any existing settings such as “same origin” when adding the new address.) The header parameter looks like this example:
  X-Frame-Options: ALLOW-FROM https://design-<region>.ci360.sas.com

  X-Frame-Options: ALLOW-FROM https://design-<region>.ci360.sas.com

  In the header, set the region variable based on the region of your tenant:

  • United States: use
  • Europe: euw
  • Asia Pacific Northeast: apn
  • Sydney: syd
  • Mumbai: mum
  Note: The X-Frame-Option parameter is deprecated and has been replaced by the frame-ancestors directive for Content-Security-Policy parameter. Different browsers handle this setting differently.

  If an ALLOW-FROM directive is already specified, you might need to modify your Content-Security-Policy parameter instead, because multiple ALLOW-FROM entries are not supported by this header.

• In the HTTP header, configure the frame-ancestor attribute in the Content-Security-Policy parameter to include the user-interface address for SAS Customer Intelligence 360. (Maintain any existing settings such as ‘self’ when you add the new server.) The header parameter looks similar to this:
  Content-Security-Policy: "frame-ancestors 'self' *.ci360.sas.com;"

  Content-Security-Policy: "frame-ancestors 'self' *.ci360.sas.com;"

  Note: The frame-ancestor attribute is equivalent to the X-Frame-Option parameter. Because the frame-ancestor attribute is not currently supported by all browsers, the X-Frame-Option header might be needed instead of (or in addition to) this attribute.

  The browser might perform unpredictably if you use the X-Frame-Option parameters and Content-Security-Policy parameters at the same time. Therefore, make sure that both parameters provide equivalent permissions, or modify only one of the parameters.