> For the complete documentation index, see [llms.txt](https://docs.userlane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.userlane.com/deployment/rollout/environment-prerequisites.md).

# Environment prerequisites

The content security policy hosts, firewall rules, and cross-origin iframe settings required for Userlane to function in a customer environment.

Userlane loads scripts, styles, and data from external hosts. If your environment restricts outbound connections through a content security policy[^1] (CSP) or a firewall, those hosts must be allowed before Userlane works. Separately, applications that embed other applications inside cross-origin iframes[^2] need a URL configuration step so Userlane can reach content inside the embedded frame.

{% hint style="warning" %}
**Prerequisites.** These steps require an IT administrator or developer with access to the web application's CSP headers, firewall rules, and (for cross-origin iframes) the Userlane portal. The browser extension must already be deployed. See [Roll out the extension](/deployment/rollout/roll-out-the-extention.md).
{% endhint %}

## Content security policy

If your application enforces a CSP, add the following hosts to the CSP header.

**Add these hosts to the `default-src`, `script-src`, `style-src`, `img-src`, `connect-src`, and `font-src` directives:**

```
https://*.userlane.com
https://*.sentry.io
https://*.amplitude.com
```

Each host serves a specific function:

* `*.userlane.com` loads all Userlane application code, styles, fonts, and images.
* `*.sentry.io` sends error reports used for application health monitoring.
* `*.amplitude.com` sends interaction data from the Userlane portal and Editor for product improvement.

{% hint style="info" %}
**Symptom when a host is missing.** The browser developer console shows an error referencing a blocked domain alongside "Content-Security-Policy" or "CORS." Userlane elements either fail to appear entirely or load without styles.
{% endhint %}

## Firewall rules

If the network restricts outbound connections through a firewall or proxy, the same three domains must be reachable over HTTPS from every device that runs the browser extension:

```
https://*.userlane.com
https://*.sentry.io
https://*.amplitude.com
```

{% hint style="info" %}
**Symptom when a domain is blocked.** Userlane may partially load or appear to load but fail silently: the Assistant does not open, content does not appear, or analytics do not record. Unlike a CSP block, a firewall block may not produce a visible console error.
{% endhint %}

## Cross-origin iframe support

Enterprise applications commonly embed third-party modules, dashboards, or older systems inside cross-origin iframes. Userlane supports content creation and delivery inside cross-origin iframes. This support is **enabled by default** for all applications and does not need to be switched on.

### Setup for browser extension deployments

For browser extension deployments, no code changes are needed. The extension automatically injects Userlane into child iframes. The only requirement is that the iframe's domain is registered in the application URL list in the Userlane portal.

If the iframe domain is not already in the list, add it by following the steps in [Set up the application URL](/getting-started/first-steps-in-the-portal/set-up-the-application-url.md).

### Limitations

Hover steps, double-click steps, right-click steps, and validators are not supported inside cross-origin iframes. Firefox does not support content creation inside cross-origin iframes.

Same-origin nested iframes are fully supported. Cross-origin nested iframes are partially supported, with reduced selector tooling.

## Troubleshooting

| Symptom                                                                                       | Likely cause                                                        | Resolution                                                                                                                                   |
| --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Browser console shows a CSP error referencing `userlane.com`, `sentry.io`, or `amplitude.com` | CSP headers do not include the required hosts                       | Add the three wildcard hosts to the CSP directives listed above                                                                              |
| Userlane loads on the main application but not inside an iframe                               | The iframe domain is not in the application URL list                | Add the iframe URL in the portal. See [Set up the application URL](/getting-started/first-steps-in-the-portal/set-up-the-application-url.md) |
| Userlane content does not appear and no console error is visible                              | Firewall or proxy blocking outbound connections to Userlane servers | Allow the three domains listed above through the firewall                                                                                    |
| Guides or tooltips do not appear on elements inside a cross-origin iframe                     | The step type is not supported in cross-origin iframes              | Check the limitations above                                                                                                                  |

## Relevant articles

{% content-ref url="/pages/ZbAA5aBZMukn2qqLRZji" %}
[Roll out the extension](/deployment/rollout/roll-out-the-extention.md)
{% endcontent-ref %}

{% content-ref url="/pages/fsN54CJn1Adx0IhuudPQ" %}
[Set up the application URL](/getting-started/first-steps-in-the-portal/set-up-the-application-url.md)
{% endcontent-ref %}

{% content-ref url="/pages/FRU06enU3lsRJrh5njNu" %}
[Troubleshoot the extension](/deployment/rollout/roll-out-the-extention/troubleshoot-the-extension.md)
{% endcontent-ref %}

{% content-ref url="/pages/T6zxTgQSzfVEsc3aDmIj" %}
[Cookies and tracking transparency](/security-and-privacy/cookies-and-tracking-transparency.md)
{% endcontent-ref %}

## FAQ

<details>

<summary>What hosts must be in the content security policy for Userlane?</summary>

Add `https://*.userlane.com`, `https://*.sentry.io`, and `https://*.amplitude.com` to the `default-src`, `script-src`, `style-src`, `img-src`, `connect-src`, and `font-src` directives of the CSP header.

</details>

<details>

<summary>Is cross-origin iframe support enabled by default?</summary>

Yes. No activation step is required.

</details>

<details>

<summary>What happens if a required host is blocked?</summary>

If a CSP blocks a required host, the browser developer console shows an error referencing the blocked domain. If a firewall blocks the host, Userlane may fail silently: the Assistant does not open, content does not appear, or analytics do not record.

</details>

<details>

<summary>Which content types do not work inside cross-origin iframes?</summary>

Hover, double-click, and right-click steps, and validators. See [Limitations](#limitations).

</details>

[^1]: A content security policy (CSP) is a browser security mechanism that controls which external domains can load scripts, styles, images, and other resources into a web page.

[^2]: A cross-origin iframe is an HTML iframe element whose source URL has a different domain from the parent page, subject to the browser's same-origin policy.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.userlane.com/deployment/rollout/environment-prerequisites.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.