I'm trying to figure out what the new Domain Whitelist for CloudPages actually does (in Setup > Security > Domain Whitelist).
I attended a Dreamforce '19 session which had a slide on this feature, which explained:
Protects CloudPage-created websites from malicious actors using URLs that redirect customers to unapproved sites.
There is a 'Learn More' link on the page which goes to a 404 error page and I can't find any documentation on this feature.
I would assume that this would only display the CloudPage landing page if the HTTP Referer Header is from a whitelisted domain. However, I've tested that and it's not the case. If I:
- Create a new page at mydomain.com with a link to a CloudPage
- Click on the Link
- Inspect the request headers to see that the Referer URL is https://mydomain.com/cp-test.html
...then the link works even if mydomain.com is not part of the whitelist.
Can someone clarify what this feature actually does?