Extension SDK Security Deep Dive
Summary
This guide covers security features of the XM Extension SDK.
Prerequisites
We recommend that you first review the XM Extension SDK overview before continuing with this guide.
Fundamentals
Extension SDK security is comprised of these features and principles:
Isolated Execution Environments
All code is run in isolated environments to protect user information and overall Extension SDK security.
Frontend code is executed in a sandbox iframe and backend code is executed in locked-down container.
API Scopes
You should use Qualtrics OAuth 2.0 scopes in your XM Extension to restrict access of your feature to only the necessary resources.
Valid Domains
XM Extensions that make outbound API calls to external systems must provide a list of owned domains that will be accessed from their XM Extension. This list is visible for all users to review and evaluate.
Usage Consent
Users must provide consent before installing and using XM Extensions. They are presented with information about the Extension, including a privacy policy and terms and conditions, and should review and agree to both
Recommended Content
Learn more about XM Extension authentication and how to implement with this guide.
Check out the OWASP security tips below:
OWASP Top 10 Proactive Security Controls
The OWASP Top Ten Proactive Controls is a list of security techniques that should be included in every software development project. They are ordered by order of importance, with control number one being the most important. This document was written by developers for developers to assist those new to secure development.
OWASP Top 10 Web Application Security Risks
The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.