Preview-based editing relies on cross-window communication (via the browser postMessage API) between Studio and the preview rendered by the CAE. To restrict which Studio origins are allowed to drive the preview, configure the allowed origins with the cae.preview.pbe.studio-url-whitelist property in your preview CAE.

The property takes a list of Studio URLs. Only messages whose origin (protocol, host and port) matches one of the configured entries are accepted.

...
cae.preview.pbe.studio-url-whitelist[0]=https://studio.example.com
cae.preview.pbe.studio-url-whitelist[1]=https://studio.intranet.example.com:8081
...

Important

If the whitelist is left empty, the preview accepts cross-window messages from any origin. For security-sensitive deployments you should always configure the Studio origins explicitly.