Tile: External embed (`externalEmbed`)
| Field | Value |
|---|---|
| Tile identifier | externalEmbed |
| Dashboard label | External embed / Einbettung |
| Category | basic |
| Sizes | embedded only |
The external-embed tile displays a booking tool or other third-party page directly in a published web app. Installed iOS and Android apps render the same restricted iframe inside their Capacitor WebView.
Accepted input
The dashboard accepts either:
- A public HTTPS URL.
- Markup containing one iframe with one quoted
srcattribute.
Only the normalized iframe URL is stored. Scoutello ignores width, height, styles, permissions, sandbox settings, event handlers, scripts, and all surrounding markup supplied by the provider. HTTP addresses, credentials, custom ports, IP addresses, local/internal hosts, Scoutello-controlled hosts, and malformed iframe code are rejected. Scoutello does not fetch, resolve, screenshot, or otherwise probe the submitted URL.
The dashboard shows a local configuration preview and deliberately does not contact the provider. Test the actual result in the published web app.
Loading, privacy, and permissions
The iframe loads automatically and lazily as it approaches the visible area. This can contact the third-party provider before a visitor interacts with the tile. There is no built-in visitor click-to-load or consent-manager flow.
Before saving, the organization must acknowledge that the provider is trusted and that any required privacy notices or consent handling have been addressed. This acknowledgement records an authoring decision; it is not visitor consent.
Mobile and desktop heights can be set from 240 to 1,600 pixels. Defaults are 640 pixels on mobile and 720 pixels on desktop. Payment and fullscreen browser capabilities are optional and disabled by default. Camera, microphone, geolocation, clipboard, downloads, and top-level navigation are never granted.
The runtime uses code-owned sandbox and referrer-policy settings. Customer-supplied sandbox or permission tokens never reach the rendered iframe. See the WHATWG iframe specification for browser sandbox semantics.
Framing limitations
Providers can prohibit embedding with a Content Security Policy frame-ancestors directive or an X-Frame-Options header. Because browsers do not expose reliable cross-origin framing-failure details, Scoutello cannot verify compatibility in the dashboard or always distinguish a provider refusal from an empty provider page.
If a saved configuration becomes invalid, the guest experience shows a safe localized error state and, when possible, an external-open fallback.
Providers that require scripts
Arbitrary provider scripts cannot run in a Scoutello page. A script-only submission is blocked and offers Request provider integration instead. The request collects the provider name, public documentation URL, intended use case, and a script sample. Remove secrets, private credentials, and personal data before submitting it.
The script sample is stored only as plain support-request text and is never rendered or executed. Approval does not unlock that snippet. It creates product work for a reviewed provider adapter hosted in a sandboxed document on a cookieless, separately registrable origin with a provider-specific Content Security Policy and origin-checked messaging. This follows OWASP third-party JavaScript guidance.
Support checklist
- Confirm that the address is public HTTPS and belongs to the intended provider.
- Confirm that the provider permits iframe embedding on the published origin.
- Enable payment or fullscreen only when the provider documentation requires it.
- Review privacy notices and consent behavior before publication.
- Use the provider-integration request for script-only widgets; never paste secrets.