Manual Embed - (iFrames)

• While you’re adding Manual Embeds, keep in mind that the embed code should come from trusted sources. This will help you avoid any security risks or funky user experiences.
• Some systems might require some extra configuration or customization to display perfectly within an iFrame. Check out the documentation or support resources for the specific system you’re embedding to ensure compatibility and the best possible display.
• Don’t forget to pay attention to the dimensions and aspect ratio of the iFrame content. We want it to fit smoothly within your Curator page. Adjust those dimensions if needed, so you avoid any cropping or weird distortions.

​

Adding a Manual Embed to a Page

1. Login to the backend of your Curator instance (e.g. https://www.curatorexample.com/backend ).
2. Navigate to the Content > Pages section from the left-hand menu.
3. Find the page you’d like to add your Manual Embed to, or click the ”+ New Page” button.
4. On the page builder editor, click the section you’d like to add your embed to, or click the ”+” icon on the page builder page to add a new section.
5. Click the “Additional Elements” tab from the “Add Element” popup and select the Embed content type.
6. Choose the dropdown option that best fits your need from the options below
   • iFrame: For use when pasting in a simple URL (e.g. https://mycuratorexample.com/embed)
   • Embed Code (HTML): For use when copying embed code from another website - this will be in HTML and can be identified by searching the copied code for </iframe> - if this string is found in your code it means you are using an iFrame to embed.
7. Once you’ve pasted the correct information in, click “Add”

​

Fitting the Frame to Its Content

• Embedded HTML files need nothing else. Curator measures the file’s height for you.
• iFrame URLs load another website, and browsers do not let Curator measure another website’s page. The embedded page has to send its own height to Curator, so only turn this on for a page you or your team control. Add this script to that page:

<script>
(function () {
    function report() {
        var height = Math.ceil(Math.max(
            document.documentElement.getBoundingClientRect().height,
            document.body ? document.body.scrollHeight : 0
        ));
        window.parent.postMessage({type: 'curator:resize', height: height}, '*');
    }
    window.addEventListener('load', report);
    window.addEventListener('message', function (event) {
        if (event.data && event.data.type === 'curator:resize-request') {
            report();
        }
    });
    new ResizeObserver(report).observe(document.documentElement);
}());
</script>

​

URL Parameter Substitution

​

Passing a verified identity with [IW_TOKEN]

https://myapp.example.com/form?iw_token=[IW_TOKEN]

• is signed with RS256 and lasts about 60 seconds, so it must be verified as soon as the embed loads;
• carries identity only — the user’s id (sub), username (preferred_username), display name (name), and email (email, when the user has one). It carries no groups or roles, so the embedded application remains responsible for its own authorization;
• is scoped to the embed’s host (the aud claim is the iFrame URL’s host), so a token minted for one embed cannot be replayed against a different application;
• includes a unique token id (jti) the embedded application should record to enforce single use;
• names Curator’s JWKS URL in the jku claim, so the application does not have to hard-code or reconstruct it.

https://<your-curator-host>/user/embedauth/jwks.json

​

Authentication Limitations

• Forward Curator session cookies or authentication tokens to the embedded application.
• Intercept HTTP 3xx authentication redirects that happen inside the iframe.
• Detect when an iframe is displaying a login page instead of the intended content.

• X-Frame-Options: DENY — The application refuses all iframe embedding; the frame appears blank.
• X-Frame-Options: SAMEORIGIN — The application only allows framing from its own origin, so it will not load inside Curator (a different origin). The frame appears blank.
• A Content-Security-Policy header on the target — The browser may block the frame depending on the policy.

1. Work with the target application’s team to explicitly allow framing from your Curator domain — for example, by setting Content-Security-Policy: frame-ancestors 'self' https://analytics.yourcompany.com on the target application.
2. Ensure the target application’s session cookies use SameSite=None; Secure so browsers transmit them in cross-site iframe requests.
3. If you control the target application, use the [IW_TOKEN] placeholder to pass a signed, verifiable identity into the embed — the application verifies it against Curator’s JWKS and establishes its own session for that user, with no inline login form and no redirect. This is the preferred option when the embed needs to trust the Curator user’s identity (for example, an authenticated Streamlit form).
4. If the target application only supports a plain-string deep link, use the [USERNAME] placeholder to pass the user’s identity to a token-exchange endpoint on the target side instead. Note that, unlike [IW_TOKEN], a plain username is not verifiable, so only use it where the target endpoint applies its own trust checks.

​

Content Security Policy and Framing Headers

• X-Frame-Options: sameorigin — Controls whether Curator itself can be framed by another site. On rendered pages this header is omitted when the portal Allow iframe embedding setting is enabled, so that Curator can be embedded elsewhere.
• Content-Security-Policy: upgrade-insecure-requests — Applied when the portal Force SSL setting is enabled. It upgrades mixed HTTP/HTTPS sub-resource requests; it does not restrict iframe sources.
• X-Content-Type-Options: nosniff — Prevents MIME-type sniffing; it does not affect iframe loading.