Initializing help system before first use

# Configuring Network Access to Insight

Xpress Insight can be configured to permit access across a network. Before configuring Insight to be accessed over a network, review the following section Securing Xpress Insight 5.

Insight can only be accessed on the URL configured in the setting `insight.server.system.url`. Access via any other URL, such as the servers IP address or an alternative host name, is denied. This prevents a type of attack known as a Host Header Attack.

## Exposing the Insight Server on the Network

After installation, the Insight server is available on the host machine localhost URL by default. This can be changed to allow users to access the server across a network. To allow a user to browse to a different network address and access Insight, complete the following:

1. Open the server `application.properties` file.
   Important: This is a java properties file which uses the backslash character to indicate an escape sequence. Paths stored in this file that use this character must be edited to ensure this is ignored. For example, C:\ProgramData\FICO\XpressInsight becomes C:\\ProgramData\\FICO\\XpressInsight.
2. Review the following lines:

       insight.server.system.url=https://server.domain.com

   Note: This file is located in the <SERVER_CONFIG_DIR>. (For more information, see Finding Configuration Files.)
3. Update `server.domain.com` with the network address.
4. Configure which IP addresses the Insight Server will be available on by amending the following lines in the server `application.properties` file:

       # The IP address this server will bind to.
       # Comment this out to bind to all of the host's IP addresses.
       server.address=139.0.0.1

   By default, Insight is available on `localhost` (127.0.0.1), preventing access over a network. For example, to make the server available on http://server.domain.com:8081, use the following settings:

       server.address=139.0.0.1
       server.port=8081
       insight.server.system.allowed-urls=https://server.domain.com

   The `insight.server.system.allowed-urls` property can be used to configure additional URLs for accessing Insight. This can be a comma-separated list, with each URL including a scheme, hostname, and optional port, as in the following example:

       insight.server.system.allowed-urls=https://example.com,http://example.org:8081

   You can also use wildcard ( `*`) characters, as in this example:

       insight.server.system.allowed-urls=https://*,http://example.com

After you have finished modifying application.properties, restart the server.

## Configuring a Remote Execution Worker

By default an execution worker will accept jobs from the Insight server running on `localhost`.

To configure an execution worker to accept jobs from Insight running on another server, perform the following steps:

1. Open the worker `application.properties` file and review the following lines:
   Note: This file is located in the <WORKER_CONFIG_DIR>. (For more information, see Finding Configuration Files.)

       # The IP address this execution worker will bind to.
       # Comment this out to bind to all of the host's IP addresses.
       server.address=127.0.0.1

       # The http port this execution worker will bind to.
       server.port=9080

       ## Accept requests on these hostnames only. 'localhost' is always
       ## allowed. Set to * to allow accept requests on all hostnames.
       #insight.worker.system.allowed-hostnames=

   Note: For example, to make the worker available on http://remote-worker-1.domain.com:9999 use the following settings:

       #server.address=127.0.0.1
       server.port=9999
       insight.worker.system.allowed-hostnames=remote-worker1.domain.com

2. Configure the worker to authenticate requests from the server.

   Execution workers authenticate requests from their server to verify the execution requests originate from an authorized source.

   The worker uses an execution authentication certificate to verify the signature of the request. This certificate is available in the <SERVER_CONFIG_DIR> directory and must be copied to the worker, enabling the worker to trust requests from that server.
   1. Locate the `insight-execution-jwt.cert` file in the <SERVER_CONFIG_DIR> directory.
   2. Copy the `insight-execution-jwt.cert` and paste into the <WORKER_CONFIG_DIR>.
   (For more information, see Finding Configuration Files.)
3. Make sure that the port specified by the `server.port=` line is opened on the machine where you are configuring the worker.
4. Restart the worker.
5. Configure Insight to use this execution worker.
   1. Log in to Xpress Insight using the web client and click the ADMIN tab.
   2. In the panel on the left, select EXECUTION > Execution Services.
   3. Click NEW EXECUTION WORKER. In the dialog, enter a Name, and the URL of the new remote worker.
      Note: If the worker URL is defined using a hostname rather than a numeric IP address, the `insight.worker.system.allowed-hostnames` property must be updated accordingly, as in this example:

          # Accept requests on these hostnames only. 'localhost' is always allowed.
          # Set to * to allow accept requests on all hostnames.

          insight.worker.system.allowed-hostnames=worker1.domain.co

   4. Click SAVE.
   Note: For more information, see the section on Administering Execution Workers and Services in the Xpress Insight 5 Administrator Guide.

Note: An execution worker will only accept jobs from one Insight server. This enables the Insight Server to manage and control the number of jobs that are running on its workers.
Parent Topic Insight 5 Administrator Guide

© 2001-2026 Fair Isaac Corporation. All rights reserved. This documentation is the property of Fair Isaac Corporation (“FICO”). Receipt or possession of this documentation does not convey rights to disclose, reproduce, make derivative works, use, or allow others to use it except solely for internal evaluation purposes to determine whether to purchase a license to the software described in this documentation, or as otherwise set forth in a written software license agreement between you and FICO (or a FICO affiliate). Use of this documentation and the software described in it must conform strictly to the foregoing permitted uses, and no other use is permitted.