I’m a software developer currently advising clients on whether to use TypeForm, inside a custom web application e.g. built with NextJS.
Security is an important aspect here, and there’s standards to prevent a website such as a TypeForm form from being embedded or iframed inside another web application based on the domain (origin) of the hosting web app.
Let’s say I have an application at https://foobar.example.com and a form with id Abc123Xyz
and that it’s included via a <Widget /> component from TypeForm’s React library. It ends up as an iframe from src like this:
https://form.typeform.com/to/Abc123Xyz?typeform-embed-id=REDACTED&typeform-embed=embed-widget&etc-etc-etc
I want to prevent users from seeing this form embedded inside domains I don’t control. Browsers offer various HTTP Headers based solutions for this:
- Content-Security-Policy (CSP) headers with frame-ancestors options
- X-Frame-Options header, a legacy way to achieve similar things
Does Typeform support such options for forms at all? I could not find anything in the documentation or via web searches.