Embedded analytics iframe fails with CORS policy violation when loading from external domain

BA/BI Qlik Sense
, , , , , , , ,
1

Our embedded Qlik Sense analytics iframe is being blocked by CORS policy when loaded from our company portal. The iframe works perfectly when accessed directly from the Qlik domain, but fails when embedded in our external application. CORS configuration seems incomplete, and the embedding domain whitelist might not be properly set up. Authentication token handling appears problematic - tokens generated for the Qlik domain don’t seem valid when the iframe is embedded. Security policy setup needs review:


Access to iframe blocked by CORS policy:
'https://portal.company.com' has been blocked
by CORS policy: No 'Access-Control-Allow-Origin'
header present on requested resource.
2

This is a common embedding issue. Have you added your portal domain to the Qlik Sense whitelist in the QMC? You need to explicitly allow cross-origin requests from your company portal domain.

3

JWT is definitely recommended for embedded analytics. It provides better security and works more reliably across domains. You’ll need to configure your authentication module to generate JWT tokens with the appropriate claims for your embedded users.

4

We’re using the Capability APIs but haven’t implemented JWT tokens yet. Currently trying to use standard session authentication. Should we switch to JWT for embedded scenarios?