Skip to content
AstratoAstratoAstrato

IFrame Object

2 min read · Updated 23 Oct 2026

Embed external web pages, apps or videos inside an Astrato workbook.

When to use:

Section titled “When to use:”

  • Dynamically show videos, docs, or vendor apps next to charts.

  • Host interactive tools that live outside Astrato.

Add it:

Section titled “Add it:”

  1. In the editor, select Graphics › Iframe.

  2. Enter the URL.

  3. Resize using the corner handles.

Security allowlist (required):

Section titled “Security allowlist (required):”

Admins must allow the domain:

  • Go to Admin › Security › Content Security Policy (CSP).

  • Add domains under Allowed iframe domains. Example:

    • https://www.youtube.com

    • https://player.vimeo.com

    • https://your.subdomain.com

  • Use HTTPS only.

Open Astrato CSP Admin

Sites that may not embed

Section titled “Sites that may not embed”

If a site sets X-Frame-Options: DENY/SAMEORIGIN or Content-Security-Policy: frame-ancestors ... that excludes your domain, it will not load inside Astrato. Ask the site owner to permit your Astrato domain.

Settings

Section titled “Settings”

  • URL: Full address to load. Query strings supported.

  • Maximize: Use the container setting for “maximize object”. Operational in preview/published mode only.

Behavior and limits

Section titled “Behavior and limits”

  • No cross-filtering with Astrato charts.

  • Performance depends on the external site.

  • Astrato does not pass your workbook session to third parties.

  • Scrolling is controlled by the embedded page.

YouTube example:

Section titled “YouTube example:”

Use the embed URL format:

https://www.youtube.com/embed/7jKfP8MZ8I8?si=_V--T08DaoSx1BZQ

Steps:

  1. Allow https://*.youtube.com in CSP.

  2. Set the iframe URL to the line above with your VIDEO_ID.

  3. Resize the object container to 16:9 for best results.

Internal app example:

Section titled “Internal app example:”

https://apps.yourcompany.com/tools/forecaster?region=EMEA

Allow https://apps.yourcompany.com in CSP.

Troubleshooting:

Section titled “Troubleshooting:”

  • Blank frame: Not on allowlist, mixed content (HTTP), or blocked by X-Frame-Options/frame-ancestors.

  • Endless login: Third‑party cookies blocked or SSO requires top‑level navigation; open in new tab.

  • Only some pages work: Path-level CSP on provider side; ask them to permit your page.

  • Slow loads: Heavy third‑party scripts on the embedded site; optimize or use a lighter page.

ℹ️Localhost is not supported - Astrato runs in the cloud.

FAQ:

Section titled “FAQ:”

  • Can I control the iframe content from Astrato? No.

  • Can the iframe read Astrato data? No.

  • Can I theme the iframe? Only via CSS provided by the external site.

  • Does it work in exports? Static image/PDF may capture a snapshot if the site allows; dynamic interactivity is not exported.