Here is our use case: We have created a cloud page. We have created a package and added a component under the package and included the cloud page url in the login endpoint and redirect endpoint. Now the user is able to access the cloud page under AppExchange menu. This is all working. What I am trying to understand is when this page gets loaded is there a way to use the JWT that is added with the package. We are trying to prevent external access of the url ,if we can check the JWT and ascertain the page is opened as an menu click within the Marketing Cloud then only we will let them see the page.

Thanks for helping.


CloudPages are publicly accessible. The only method to restrict access would be to limit by IP address. Note that this isn't a 100% secure solution (it could still in theory be open to IP address spoofing to impersonate a request from SFMC), but if your OK with that, then read on.

The IP address used by Marketing Cloud to post the encoded JWT to your CloudPage using the SSO flow uses a fixed IP address (although I believe the IP address may vary depending on what stack you are using).

There's no server side function (AMPscript or SSJS) to retreive the IP address, but using the code below, you can retrieve the IP address using the free jsonip.com service.

For some odd reason, GET requests over SSJS fail to this endpoint (I'm not sure why), so you will need to use a combination of AMPscript (to make the request) and GTL (to parse the JSON response).

Using the code below, you can get the value of the @ip variable used by SFMC to post the JWT and then update the static value 12.34.567.8 below to reflect this.

Note that you should keep both instances of the %%{={{ }}=}%% syntax, as this is required to escape OMM delimiters.

var @getip, @ip
set @getip = HTTPGet('https://jsonip.com/')
/* %%{={{ }}=}%% escape OMM delimiters, do not delete this comment */
{{.datasource response type=variable source=@getip}}
%%[ set @ip = TreatAsContent('%%{={{ }}=}%%{{ip}}') ]%%


if @ip != '12.34.567.8' then /* IP address used by SSO to call CloudPage */


You are unauthorised to view this page.

  /* insert code here */
  • Yeah cloud pages is missing the authentication and security functions that were allowed in Microsites feature in Email Studio. I have heard nothing about them bringing these features across, preventing a lot of possibilities that SFMC web pages could produce. This leaves only manually created security measures, many of which are either too complex to provide value in a Cloud page, or are too insecure to reduce enough risk. – Gortonington Aug 13 '18 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.