---
title: "Decisions Platform in an iFrame"
slug: "decisions-platform-in-an-iframe"
description: "This document shows how to change the web.config file, so that the Decisions portal can be opened in an iFrame outside of the same site."
tags: ["CORS"]
updated: 2025-06-12T16:35:22Z
published: 2025-06-12T16:35:22Z
---
> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.decisions.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Decisions Platform in an iFrame
## Overview
Inline Frame(iFrame) is a unique HTML tag that loads another HTML Page within the same document. Decisions can also be accessed through iFrame. By default, this setting is not enabled.
The following document demonstrates how to enable the accessibility of Decisions within iFrame.
---
## Generating Integration URL
To run decisions within iFrame, users must generate a [Decisions Integration URL](/v9/docs/view-integration-details). This URL should be embedded in the HTML iFrame tag to access Decisions.
---
## Server-Side Setup
1. Open [Settings.xml](https://documentation.decisions.com/v9/docs/system-settings-overview-settings-xml), located at `C:\Program Files\Decisions\Decisions Server`. Add the following CustomHeaders in Settings.xml. Replace `https://*.example.com` with the desired URL to embed Decisions in iFrame.
**Note**: `https://*.example.com` specifies that any subdomain under example.com using the HTTPS protocol can embed the content in a frame. The asterisk (*) acts as a placeholder for any subdomain name.
```markup
Content-Security-Policy
frame-ancestors 'self' https://*.example.com;
```
2. Users must change the DefaultSameSiteCookieMode to **None**from the Settings.xml file. By default, this setting is set to **Lax.**This cookie requirement is universal across all sessions, mandating that decisions possess the capability to transmit cookies to display data within the iFrame.
**Note:** Users will not be able to log in if they attempt to set DefaultSameSiteCookieMode to false if they are not using [SSL](https://documentation.decisions.com/v9/docs/configuring-the-server-for-ssl-https).
```markup
None
```
3. Save and close the Settings.xml file.
4. If SSL termination occurs at the Load Balancer/Proxy/Application Gateway and redirects the requests from HTTPS to HTTP on the application, it is essential to secure the cookies. For more information, refer to [Configuring Cookies](https://documentation.decisions.com/v9/docs/securing-decisions-installation#configuring-cookies).
5. [Restart](https://documentation.decisions.com/v9/docs/restart-decisions-application) the Decisions instance.
Reminder!Each browser has different compatibility with these settings. To verify that the browser will honor the desired setting, refer to the **Browser Compatibility** chart on Mozilla's website by using the following link: [Mozilla's X-Frame Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).
---
## Example for Decisions in iFrame
In the following example, we will see how we can access a Flow activity of Decisions within an iFrame.
- Creating an HTML, including an iFrame and hosting that HTML file in Windows Information Internet Services (IIS) Manager
- Configure the Server-Side Setup
- Configure the Integration URL of the Flow and add the URL in the iFrame Tag.
---
### Creating an HTML file and hosting it in Windows Information Internet Services (IIS) Manager.
1. Open Notepad, and copy and paste the following code to it. Save it in HTML file format to the desired location. Name the File **iframe.html**.
```markup
```
2. Ensure to enable [Information Internet Services](https://learn.microsoft.com/en-us/iis/application-frameworks/scenario-build-an-aspnet-website-on-iis/configuring-step-1-install-iis-and-asp-net-modules).
3. Open **Information Internet Services (IIS) Manager**. From the left **Connections** pane, right-click on **S****ites****> Add Website**.
4. **Add Website** dialog box appears. Give a **Site Name**.****Under the **Physical path**, navigate to the Folder where the HTML file is saved. Under **Port,**give port no. 8085, Click **OK**. Close the dialog box.
5. Visit this URL [http://localhost:8085/iframe.html](http://localhost:8085/iframe.html) to see if the HTML Page containing the iFrame is operational. An iFrame window with a 404 error should be visible.
### Server Side Settings
1. Follow steps 1-2 from the above Topic **Server Side Setup Configuration**.
```markup
Content-Security-Policy
frame-ancestors 'self' http://localhost:8085
```
2. Copy the above code to **Settings.xml.**Refer to the following image.
3. Save and close the Settings.xml file. [Restart](https://documentation.decisions.com/v9/docs/restart-decisions-application) the Decisions instance.
---
### Generating Flow Integration URL
1. Open a [Flow Designer](/v9/docs/create-flows) in Decisions and add a [Form](/v9/docs/forms). Here we have added an **Employee Detail Form** to a Flow Designer. Refer to the following image..png)
2. To generate the Integration URL of the Flow, refer to [User Interface Integration](https://documentation.decisions.com/v9/docs/view-integration-details?highlight=User%20Interface%20Integration) and copy the Integration URL. Refer to the following GIF. .gif)
3. Open the HTML file where the iFrame code is present. Replace `paste_integration_link` with the configured Integration URL. Save the HTML file. Refer to the following code block for reference.
```markup
```
4. Open incognito mode in the browser and visit this URL `http://localhost:8085/iframe.html` to see if the HTML Page containing the iFrame is operational.
For further information on Integrations, visit the [Decisions Forum](https://community.decisions.com/categories/Integrations).