32 lines
2.1 KiB
Markdown
32 lines
2.1 KiB
Markdown
|
# Company white label and start page
|
|||
|
|
|
|||
|
|
Administrators configure the company name, color and PNG logo in the central
|
|||
|
|
console. Logo upload is decoded and re-encoded, bounded to 128 KiB and 1024 × 1024.
|
|||
|
|
SVG, remote image URLs and active content are not accepted. Publishing uses the
|
|||
|
|
existing signed versioned policy and independent review when configured.
|
|||
|
|
|
|||
|
|
Branding appears on the browser start/new-tab page, sidebar, settings, enrollment,
|
|||
|
|
AI and password views; the native window title follows the company name. Website
|
|||
|
|
content remains unchanged. Remove the logo and publish to remove the custom artwork.
|
|||
|
|
Installer/executable branding remains the existing deployment build configuration;
|
|||
|
|
this policy changes the running browser UI without replacing the signed binary.
|
|||
|
|
|
|||
|
|
Start page controls provide a heading, company message and optional RSS/Atom URL.
|
|||
|
|
News is centrally fetched, cached for one minute and refreshed by devices within
|
|||
|
|
five minutes or on policy changes. The shell displays at most 12 plain-text items
|
|||
|
|
and opens articles through normal managed navigation. Feed HTML and scripts are
|
|||
|
|
never inserted into the shell. Failures clear news without pausing browsing.
|
|||
|
|
|
|||
|
|
Feeds require HTTPS on port 443, no embedded credentials, no redirects and bounded
|
|||
|
|
UTF-8 XML. Query parameters are supported. Do not put authentication tokens in feed
|
|||
|
|
URLs or policy. Private corporate feed hosts require exact deployment entries in
|
|||
|
|
`COMPANY_NEWS_ALLOWED_HOSTS` (comma separated). DNS addresses are validated and
|
|||
|
|
pinned per connection; loopback and mapped loopback destinations remain forbidden.
|
|||
|
|
Authenticated/SSO-only feeds need a future separately protected server credential
|
|||
|
|
integration; the current reader consumes feeds accessible to the management server.
|
|||
|
|
|
|||
|
|
Policy fields: `brand.logoDataUrl` and `startPage.{title,subtitle,newsEnabled,feedUrl}`.
|
|||
|
|
News is obtained through the authenticated device route `/api/device/start-page/news`,
|
|||
|
|
bound to the effective policy version. The response contains title, HTTPS link and
|
|||
|
|
optional publication date, never raw XML. `startpage.news` exports timed backend
|
|||
|
|
OpenTelemetry spans without feed URL/body fields.
|