Preview-based editing relies on cross-window communication (via the browser postMessage API) between Studio and the preview rendered by the preview client. On receiving the handshake message, coremedia.preview.js injects a script provided by the sender, so the origins that are allowed to drive the preview must be restricted.

For the bundled JSON Preview Client, configure the allowed origins with the previewclient.studio-url-whitelist property on headless-server-preview. The property takes a list of Studio URLs; only messages whose origin (protocol, host and port) matches one of the configured entries are accepted.

previewclient.studio-url-whitelist[0]=https://studio.example.com
previewclient.studio-url-whitelist[1]=https://studio.intranet.example.com:8081

For a custom preview client (see Section 3.4.3, “Custom Preview Client”), set the same list as the global JavaScript variable window.coremedia.preview.studioUrlWhitelist before coremedia.preview.js is loaded.

Important

If the whitelist is left empty, the preview accepts cross-window messages from any origin. For security-sensitive deployments you should always configure the Studio origins explicitly.