We're rebuilding a Classic app with the new React App Builder (self-hosted, Retool 4.86.0). The Classic app embeds a Metabase static-embed dashboard in an IFrame component with "Allow same origin" enabled, and it works.
In the React app we render <iframe src="https://<our-metabase>/embed/dashboard/<signed-token>">. We added the Metabase origin under Settings > App security > Content Security Policy (frame-src), and the app response now shows frame-src 'self' https://<our-metabase>. The iframe still renders blank.
Cause: the app document is served with a CSP sandbox directive that doesn't include allow-same-origin (sandbox allow-scripts allow-forms allow-popups ...). Nested iframes inherit those flags, so the embedded page runs with an opaque origin and Metabase's frontend fails to start. We reproduced it outside Retool: the same Metabase embed URL renders in a plain iframe and is blank in an iframe with the same sandbox flags. Metabase itself allows framing (frame-ancestors *).
Questions / request:
- Is there a setting (org-level or self-hosted env var) to allow allow-same-origin for iframes inside React apps, like the Classic IFrame's "Allow same origin" option?
- If not, could the custom CSP settings also allow per-origin sandbox exceptions for trusted embeds (BI tools like Metabase, Looker, etc.)?
Thanks!
Summary
On self-hosted Retool 4.86.0, an app rebuilt in the new React app builder renders an embedded Metabase static-embed dashboard blank: the app document is served with a CSP sandbox directive lacking allow-same-origin, which nested iframes inherit (opaque origin), so the embed fails even after adding the Metabase origin to a custom frame-src rule.
AI Response
This behavior is expected. New app builder apps are governed by an org-wide Content Security Policy, and the custom CSP feature only lets admins add source expressions to a fixed set of directives (script-src, connect-src, frame-src, style-src, worker-src, form-action, frame-ancestors, and img/font/media-src). The document sandbox directive is not among the configurable directives, and Retool-enforced ('Required') rules cannot be changed, so there is currently no org-level or self-hosted setting to add allow-same-origin to the app sandbox or to grant per-origin sandbox exceptions for trusted BI embeds — unlike the classic IFrame component's 'Allow same origin' option. Adding the Metabase origin to frame-src is the correct and only exposed control, but it does not override the inherited sandbox flags. There is no documented workaround to restore allow-same-origin for nested iframes in new builder apps today; this gap can be tracked via the related community threads below, where Retool product staff have been iterating on CSP/embedding flexibility for the new builder.
Sources
Customize the Content Security Policy for apps | Retool Docs
Authoritative list of exactly which CSP directives admins can customize for new builder apps (Cloud and self-hosted) — frame-src is included but the sandbox directive is not, and Required rules can't be changed.
New React App Builder Iframe CSP Settings
Solved thread where Retool staff introduce the customizable CSP (frame-src allowlisting) for new builder apps, confirming it is the intended mechanism for permitting external iframe domains.
The Community Team is testing out a new automation. Let us know if it's helpful (or not) by leaving a 
, 
, or 
. Or by marking this post as the "Solution"! Let us know if you have any feedback here. 
Unfortunately, on self-hosted, published React apps run in a sandbox without allow-same-origin for security reasons, and iframes inside the app inherit it.
Some good news–hostname-based serving for self-hosted will be available in the upcoming stable release, so your embedded app should work once you set up hostname-based serving.
Thank you for the response @Isabella_Borkovic, I am really sorry, I said that we where on self-hosted but we aren not (that happens for too much Claude reliance for writing and not double check 
).
we are on retool cloud. is this possible on retool cloud ?
thank you.
Lorenzo C. Verduzco