This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Table of contents

• Why enable multiple URLs
• How it works
  • Configure multiple URLs
  • Input rules
  • Force HTTPS with multiple URLs
  • SSO and identity providers
  • Work with domain manager
• Best practices

Multiple server URLs let you control from which domains users can access the application. Administrators can list several allowed domains instead of relying on a single entry point.

Why enable multiple URLs

• Internal vs external access - give employees a private domain while exposing a separate one for customers or partners
• Single sign-on requirements - many SSO providers bind logins to a single domain; with multiple URLs you can support both internal SSO and external SSO flows
• Security hardening - redirect users who open the app from unapproved domains to the primary URL
• Business continuity - keep backup domains to handle DNS outages or corporate network routing issues
• Smooth migrations - support both old and new domains during a transition period without breaking access

Tip: Always configure Force HTTPS first, so all listed domains redirect consistently to HTTPS.

How it works

• add one or more domains in Allowed server URLs (line-separated)
• the first domain becomes the primary entry point - all redirects point there
• users opening the app from unlisted domains get redirected to the primary URL
• if no domains are listed, the app accepts requests from any domain

Configure multiple URLs

1. Go to Settings -> Administration -> Server configuration
2. Find Allowed server URLs
3. Enter domains, one per line
4. Press Save

You can also add domains directly in the server configuration file under the supportedHosts list. When a domain is generated through the CloudBeaver (with Domain Manager), it’s added to Allowed server URLs automatically. For details, see Server configuration.

Input rules

• enter hostnames only, without scheme or path, for example:

  Example:

  app.example.com
  app-ext.example.com
  

• if you paste a full URL, the server keeps only the host during parsing

• separate entries with line feeds

• the field is editable and optional

• values are validated - extra symbols, paths, and wildcards are rejected

Warning

: The server never redirects to a host that isn’t on this list.

Force HTTPS with multiple URLs

• HTTPS enforcement is controlled by Force HTTPS
• when Force HTTPS is on, the app redirects http:// to https://
• when domains are created automatically by Domain Manager, the flag is also switched to HTTPS

How Force HTTPS and multiple URLs work together

• Force HTTPS - ensures all traffic is encrypted and cookies are secure
• Multiple server URLs - restricts access to approved domains and sets a primary redirect target

Combined, they guarantee secure and consistent access.

SSO and identity providers

• during OAuth and other SSO flows, the app uses the current request URL, not a legacy single “server URL” value
• restricting the list helps avoid redirects to unapproved domains during login

Work with domain manager

• if you use Domain Manager, add new domains to the end of the list
• don’t replace existing entries - keep historical domains during migrations until traffic fully moves

Best practices

• keep 3-5 domains max
• prefer DNS names
• put the domain you want in browser address bars first
• review proxy rules for nginx or haproxy so external HTTPS requests are passed correctly