1. Guide
  2. Using Oracle Spatial Studio
  3. Spatial Studio Administration Page
  4. Managing Safe Domains

3.8.2 Managing Safe Domains

As an administrator, you can add a ___domain of a custom basemap or a WMS service to the Content Security Policy directives of your Spatial Studio application.

Alternatively, you can edit or delete an existing safe ___domain.

Note:

If you make any changes to the safe domains list, then it is important that you refresh or reload the browser page to reload the new Content Security Policy.
  1. Navigate to the Administration page.
  2. Click Safe Domains under Settings.
    The list of safe domains to which Spatial Studio has access is displayed as shown:

    Figure 3-45 Safe Domains

    Description of Figure 3-45 follows
    Description of "Figure 3-45 Safe Domains"

    You can choose to perform one of the following actions:

    • Adding a safe ___domain
      1. Click Add.

        A new row gets added to the end of the safe domains table list.

      2. Double-click the Domain Name cell of the empty new row to enter the new ___domain.

        Ensure that you enter only the ___domain part of an external URL (that is, the protocol, host name or IP address, and port) from which you will be fetching the resources. For instance, https://wms.mycompany.com:8080 or https://wms.mycompany.com.

        Note that the protocol is a part of the ___domain and should be based on the URL of the remote service. For instance, if you defined a WMS data source or a custom base map in Spatial Studio, and the URL to the WMS server or the custom base map's tile server starts with https://, then you must use https://. If it starts with http://, then use http://. In case if both the protocols are used (maybe one is used to fetch some resources while the other is used for a different type of resource), then you need to add the ___domain twice, one with the http:// protocol and another with the https:// protocol. Spatial Studio performs safe ___domain validation strictly based on the value you added to the list.

      3. Select the appropriate check boxes.

        The check boxes represent Content Security Policy fetch directives.

        • Connect: This corresponds to the CSP connect-src directive, and indicates whether Spatial Studio is allowed to interact with the ___domain via script interface (such as AJAX calls).
        • Image: this corresponds to the CSP img-src directive, and indicates whether Spatial Studio is allowed to fetch images from the ___domain.
        • Script: this corresponds to the CSP script-src directive, and indicates whether Spatial Studio is allowed to import or load scripts hosted by the specified ___domain.
        • Font: this corresponds to the CSP font-src directive, and indicates whether Spatial Studio is allowed to load font data from the specified ___domain.
        • CSS Style: this corresponds to the CSP style-src directive, and indicates whether Spatial Studio is allowed to load stylesheet from the specified ___domain.

        It is important to understand what type of resources you will be fetching from the specific ___domain. For instance, if you select the check box Script, then it implies that you are enabling your browser to fetch Java Script type resources from the ___domain.

        In case if you are adding a safe ___domain for a WMS data source, then you likely need to enable the following check boxes:

        • Connect: This is required because Spatial Studio needs to interact with a remote WMS data source to check its capabilities using AJAX calls.
        • Image: This is needed because eventually Spatial Studio needs to fetch individual WMS map images from the remote WMS server.

        Note that when a check box is selected, the ___domain URL gets added to a list of all the allowed URLs for the corresponding CSP directive. For instance, consider that the ___domain https://www.mycompany.com is added as a safe ___domain with the Connect check box selected. Then, when you reload Spatial Studio, the CSP header loaded by the browser will now include https://www.mycompany.com in its connect-src directive's list of ___domain values.

      4. Click Save Changes.
      5. Ensure to refresh or reload the browser page.
    • Editing a safe ___domain
      • Double-click the required safe ___domain table row and edit the required details.
      • Click Save Changes.
      • Ensure to refresh or reload the browser page.
    • Deleting a safe ___domain
      • Double-click the required safe ___domain row in the table.
      • Click close_icon and confirm delete by clicking OK.
      • Click Save Changes.
      • Ensure to refresh or reload the browser page.

Parent topic: Spatial Studio Administration Page