IAT Software

Hosting from another site

The test always runs on iatsoftware.net. You can send participants straight to that HTTPS address. Use this page only if you need the test to appear on your own host — a course site, an LMS, a lab domain.

Two ways. A reverse proxy makes the test look like it lives under your domain. An iframe puts the iatsoftware.net window inside your page. The proxy is the more reliable of the two. Browsers have spent years breaking third-party cookies inside iframes. The session cookie the test uses is one of those cookies.

People call the first option a forward proxy. The config you actually want is a reverse proxy: your server accepts the participant’s request and fetches the test from us.

Before you start

Use HTTPS on your site. Mixed content will block scripts and images.

Copy the participant URL from the designer after a successful deploy. It is an https://iatsoftware.net/… address with no www. That is the origin you proxy or put in the iframe src.

Tell me the exact origin you will embed from (scheme + host). CORS and, for iframe use, framing will be allowed for that origin. A file:// page or an http:// lab machine will not be added.

Do not proxy the whole of iatsoftware.net. Do not proxy /IAT/Upload, result download, or anything that is not the participant path for your test.

Set Redirect on complete in the Deploy tab to a page you control. Default is https://iatsoftware.net, which is our site, not yours.

1. Reverse proxy

Participant visits https://yourlab.edu/study/ and your server fetches the test from us. The browser sees your domain, so cookies are first-party. This is the path to use if an IRB or an LMS wants the URL on your host.

nginx

location /study/ {
    proxy_pass https://iatsoftware.net/;
    proxy_ssl_server_name on;
    proxy_set_header Host iatsoftware.net;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_redirect https://iatsoftware.net/ /study/;
}

Tighten proxy_pass to the participant path of your test once you have it, not the site root. The Upgrade headers are there because some administration requests use WebSocket. If a first test run fails with a mixed-content or 502, the usual cause is proxy_ssl_server_name missing or proxy_pass pointed at http.

Apache

Enable proxy, proxy_http, proxy_ssl, headers. Then:

SSLProxyEngine on
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyPreserveHost off
ProxyPass /study/ https://iatsoftware.net/
ProxyPassReverse /study/ https://iatsoftware.net/
RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}

Those three SSLProxyCheckPeer* offs are what made the HTTPS hop work on Apache. They mean Apache does not verify our certificate on the backend connection. Prefer checks on if a current httpd + a complete chain will handshake; if the proxy returns 500/502 on SSL and the error log says certificate verify failed, this is the stanza that has been used.

Caddy

handle_path /study/* {
    reverse_proxy https://iatsoftware.net {
        header_up Host iatsoftware.net
    }
}

IIS

Use Application Request Routing. Reverse-proxy https://iatsoftware.net/ under a /study application. Preserve the original Host as iatsoftware.net. Enable SSL offload only if the public site is already HTTPS.

After the proxy works, set Redirect on complete to https://yourlab.edu/thanks/ or whatever page you want them to see when the test finishes. That navigation happens in the test window, which in this setup is your window.

2. iframe

Use this when the test has to sit inside a page you already have — a consent screen above, a course template around it. CORS from your origin will be allowed. Framing from your origin will be allowed. That does not fix third-party cookies. If a participant’s browser blocks them, the test can fail to keep a session. If that happens, switch to the proxy.

Put the official HTTPS participant URL in the iframe src. Give the frame a height that can hold the layout you designed. Do not point the iframe at http://www. Anything.

Redirect on complete runs inside the iframe. It changes the frame, not the parent page. Point it at a short “you are finished” page if you want the frame to go somewhere. To leave your host page entirely, put a Done button on the parent under the iframe and navigate the parent yourself. Do not expect the test to break out of the frame.

Example parent page: a heading, the iframe, a Done button whose click sets window.location to your next course URL. Hide or disable Done until you are willing for them to leave; the test cannot tell your button that it finished unless you watch Redirect on complete inside the frame.

3. Redirect on complete

This is a field on the test, set in the designer before you deploy. It is a URL. When administration finishes, the test window goes there. It is not a JavaScript hook and it is not a postMessage API.

Leave it blank and the software uses https://iatsoftware.net. Set it if you have somewhere else they should land.

What this page will not do

It will not hide that the data is stored on iatsoftware.net. Encryption and retrieval still work the same. Your proxy does not get a copy of the results.

It will not let you change the test by rewriting HTML on the way through. If you need different instruction text, change it in the designer and deploy again.

It will not document a custom domain on our certificate. Your proxy terminates TLS on your name. Ours stays on iatsoftware.net.

Back to docs · Privacy