Why do private embed links resolve to a "public.domo.com" address?

JunkDoom

Our private embeds resolve to an address at public.domo.com. Is this normal? For example, if I go to a link like:

https://mycompany.domo.com/embed/pages/n1234

I get redirected to public.domo.com address like this:

https://public.domo.com/embed/pages/n1234

The embeds do not seem to actually be public. When trying to access when not logged in to Domo, you do end up at the login screen, and then get redirected to the dashboard. Why is this? Why doesn't the address stay at mycompany.domo.com?

GrantSmith

This is the embed server that handles embedding. It's a bit confusing with the domain being public but all the logic is handled there for private and public embedding. @ChrisBaker@chrishaleua may be able to shed some more light on this.

[Deleted User]

Great feedback. I agree a different domain would be more intuitive. We have considered eventually changing it to embed.domo.com instead.

In the meantime, rest assured this is definitely working as designed. When private embed URLs resolve to public.domo.com, that just means the APIs they reference are publicly documented on developer.domo.com and available to be used as long as you have a secure client ID and secret where only authenticated activity will actually render any content.

GrantSmith

This is the embed server that handles embedding. It's a bit confusing with the domain being public but all the logic is handled there for private and public embedding. @ChrisBaker@chrishaleua may be able to shed some more light on this.

JunkDoom

@grace@GrantSmith Even if it is private, which is does appear to be, it's still concerning. Hopefully Domo will change this in the future so there's no confusion.

[Deleted User]

Great feedback. I agree a different domain would be more intuitive. We have considered eventually changing it to embed.domo.com instead.

In the meantime, rest assured this is definitely working as designed. When private embed URLs resolve to public.domo.com, that just means the APIs they reference are publicly documented on developer.domo.com and available to be used as long as you have a secure client ID and secret where only authenticated activity will actually render any content.

Ken_Boyer

In response to customer concerns and security considerations. Going forward after the 25th of April, all new embedded content will resolve to a different prefix after authentication.

Customers will see a prefix of "embed.domo.com” instead of “public.domo.com” for embedded content. We are also working on visual indicators to show privately vs. publicly embedded content to help reduce confusion.