Spotfire® Server and Environment Security

JavaScript in Text Area

To customize parts of the application that cannot be done using sanitized HTML in the Spotfire text area, you can add snippets of JavaScript.

Component Description
Authorization Members of the Script Author group mark scripts as trusted for execution by others.
Execution context JavaScript runs in a web browser that does not have direct access to the operating system API. It can use a subset of the functions provided by the Spotfire application for the user who is currently logged in. If a user opens a file containing trusted JavaScript on the Spotfire Web Player, then the script can access anything the user has permission to access in the domain running the Spotfire Server (according to a security policy in browsers referred to as same origin policy). For this reason, only trusted users should be members of the Script Author group.