0

Has anyone ran into any issues, with multiple SSL sites and deep linking? Basically what I am asking is if there is content on ssl site one and content on ssl site two, and you are deep linking with content/images from both SSL servers - any weird errors? Im pretty sure this is fine but am looking for other opinions.

Thanks for your feedback.

  • "Deep linking" being an <img> tag in a page on SSL Site 1 where the src attribute refers to a resource hosted on SSL Site 2? – Macca May 9 at 8:00
  • @Macca exactly. – Zucco May 9 at 10:23
1

In principal, you can incorporate images, css and scripts into your SSL page from another site, providing they're served over SSL. There are exceptions, however. If the SSL page in Site 1 includes Content Security Policy headers along with the page being rendered in the browser and those headers restrict where assets of various types may be loaded from, the browser will refuse to load those assets.

Adding specific CSP directives to Marketing Cloud CloudPages is good practice and helps protect visitors of the page against cross site scripting attacks. If you want to guard against XSS vulnerabilities on your Marketing Cloud page (Site 1), ensure you allow the serving of assets from Site 2. The example below allows the serving of images from Site 2 in your Site 1 page:

<script runat="server">
    Platform.Load("Core","1");
    Platform.Response.SetResponseHeader("x-content-type-options","nosniff");
    Platform.Response.SetResponseHeader("x-frame-options","SAMEORIGIN");
    Platform.Response.SetResponseHeader("default-src","'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';");
    Platform.Response.SetResponseHeader("X-Xss-Protection","1; mode=block");
    Platform.Response.SetResponseHeader("Strict-Transport-Security","max-age=31536000; includeSubdomains");
    Platform.Response.SetResponseHeader("Content-Security-Policy","default-src 'none'; script-src https://cloud.site1.com; style-src https://cloud.site1.com; img-src https://https://cloud.site1.com https://cloud.site2.com; connect-src https://cloud.site1.com; child-src 'self'");
    Platform.Response.SetResponseHeader("Referrer-Policy","strict-origin");
</script>

It's also possible for Site 2 to apply rules based on the Http Referrer header to disallow serving of assets in pages not hosted by Site 2 (see Apache's mod_rewrite).

| improve this answer | |
  • Thanks @Macca this is a great answer, appreciate you taking the time! – Zucco May 13 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.