Security headers are used to make web applications more secure.
The documentation around them is technical in nature, and for that reason we will refer to external resources found here: https://developer.mozilla.org/.
This article gives an overview of which security headers are available in Playable. You can access these under Account > Developer
Note! The developer tab can only be accessed by users with an account administrator role.
Content Security Policy
Content Security Policy (CSP) covers a wide range of headers. In Playable, you can enable frame ancestors, which restricts where your campaign can be iframed. To view your accounts Security headers navigate to Account > Developer > Security headers.
Enable frame ancestors to restrict which domains are allowed to display your campaigns in an iframe. Enter the allowed source values using valid Content Security Policy syntax.
Examples:
https://example.comallows embedding from https://example.com only.https://*.example.comallows embedding from HTTPS subdomains such as https://campaign.example.com, but not from https://example.com itself.example.comallows embedding from example.com across schemes such as https://example.com and http://example.com, but does not include subdomains.*.example.comallows embedding from subdomains such as https://campaign.example.com and http://campaign.example.com, but does not include example.com itself.
For most setups, we recommend adding both the main domain and its subdomains explicitly, for example:
https://example.com
https://*.example.com
This allows embedding from both the main domain and HTTPS subdomains.
Invalid wildcard examples:
*example.com
*campaign.example.com
example*
If you are embedding your game in a hybrid app, you will want to make sure frame ancestors are disabled.
Referrer Policy
Referrer policy controls how much information can be sent along in external links from your campaign to another URL.
This could be, for example, including Playable as the source of traffic to your website.
You can select your preferred referrer policy from the drop-down menu.
Read here for more information.
Permissions Policy
Permissions policy controls which browser features can be used on your campaign (for example, geolocation).
If you enable this setting in Playable, you will be able to build your own permissions policy in the free text input field.
Read here for more information.