1

I created another post to ask how to load data extension in Custom Activity UI. Now another question: how can I secure the endpoint page, so I know it is from that Marketing Cloud Journey Builder Business Unit instance?

for example, if my UI endpoint is https://www.mysite.com/endpoint/, I can see it is embedded as iframe in Journey Builder, but there is no parameter passed to endpoint, how can I secure it so it only loads if it is used for that Marketing Cloud instance? Is there any SSO or access token passed to Endpoint applicaiton? This is only for Custom Activity UI, NOT the data workflow after journey is activated.

enter image description here

Improve this question

1 Answer 1

Reset to default
2

You can secure access by using "useJwt": true in each of your activity arguments as documented here and here:

When your application is called, Marketing Cloud posts the encoded JWT to the activity's endpoint. The JWT lets your application know that the user calling the API is from Marketing Cloud.

However, it appears you wan to restrict access to the index.html file. In that case, the only way that I can think of is to build in IP address restriction, so that you will only accept requests from Marketing Cloud. The complete list of IP addresses used by Marketing Cloud is listed here, you don't need all of these. I can't recall which ones that Journey Builder uses, but it would be very easy for you to check.

Improve this answer
3
  • thank you @Eliot, will test the activity and mark the answer accepted later :)
    – Bo Hu
    Oct 5, 2017 at 0:45
  • 1
    I looked into this, given the request for Index/config.json comes from the browser, not mc servers, it doesnt seem possible to validate against the IP of Marketing Cloud. @Bo Hu, did this end up working for you somehow?
    – Doug
    Oct 25, 2017 at 8:06
  • @Doug You are right, httpreferrer uses user browser IP address than the SFMC server IP. so IP restriction check is not possible. The only 'restriction' I think may work: on index.html, check if window.top contains MC url pattern, if not matching, hide the content etc.
    – Bo Hu
    Oct 25, 2017 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.