Embedded dashboard URL params for dynamic date filtering

I have an embedded dashboard with filters hidden. The date range defaults to 90 days.

I want to pass along a date parameter in my requests to looker so the user can select dates client-side and we can render the dashboard appropriately without exposing the filters to the user. Is this possible? If so, what params do I need to pass?

This docs page: https://docs.looker.com/reference/embedding/embed-javascript-events goes into this process in great depth! If you’ve got questions about anything there, let us know.

Ah, thanks!
Is there risk involved in whitelisting localhost for development?

That’s an interesting question! I can’t see how, since when you serve the application yourself that’s the only time it would be accessible via localhost— And then only from your machine. That said, I’ve asked some of the embed wizkids we have to see if any of them have input.

Bit more on this @Krista_Prokopczyk : After talking with @fabio and some others, the general consensus is that even though whitelisting localhost does open up an attack surface in that anything running on that same server will have carte blanche to make cross-domain messages to that iframe (from localhost), if you already have malicious software running on the server, you’ve got bigger fish to fry and your data is already probably at high risk.

So although it technically does create a greater risk of exploitation, in practical terms, it does not make a real difference. Also worth noting that the amount of information exposed through these iframe messages is pretty minimal.

Just to be clear, the “localhost” domain here refers to anything running locally on the machine of a user that is accessing Looker via an embed iframe. However, the same logic applies - malware on the machine of an end-user with access to Looker would be the main risk in and of itself.

1 Like

Oooh, thanks for the clarification there. Makes sense.