0

Has anyone ran into any issues, with multiple SSL sites and deep linking? Basically what I am asking is if there is content on ssl site one and content on ssl site two, and you are deep linking with content/images from both SSL servers - any weird errors? Im pretty sure this is fine but am looking for other opinions.

Thanks for your feedback.

2
  • "Deep linking" being an <img> tag in a page on SSL Site 1 where the src attribute refers to a resource hosted on SSL Site 2?
    – Macca
    Commented May 9, 2020 at 8:00
  • @Macca exactly.
    – Zucco
    Commented May 9, 2020 at 10:23

1 Answer 1

1

In principal, you can incorporate images, css and scripts into your SSL page from another site, providing they're served over SSL. There are exceptions, however. If the SSL page in Site 1 includes Content Security Policy headers along with the page being rendered in the browser and those headers restrict where assets of various types may be loaded from, the browser will refuse to load those assets.

Adding specific CSP directives to Marketing Cloud CloudPages is good practice and helps protect visitors of the page against cross site scripting attacks. If you want to guard against XSS vulnerabilities on your Marketing Cloud page (Site 1), ensure you allow the serving of assets from Site 2. The example below allows the serving of images from Site 2 in your Site 1 page:

<script runat="server">
    Platform.Load("Core","1");
    Platform.Response.SetResponseHeader("x-content-type-options","nosniff");
    Platform.Response.SetResponseHeader("x-frame-options","SAMEORIGIN");
    Platform.Response.SetResponseHeader("default-src","'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';");
    Platform.Response.SetResponseHeader("X-Xss-Protection","1; mode=block");
    Platform.Response.SetResponseHeader("Strict-Transport-Security","max-age=31536000; includeSubdomains");
    Platform.Response.SetResponseHeader("Content-Security-Policy","default-src 'none'; script-src https://cloud.site1.com; style-src https://cloud.site1.com; img-src https://https://cloud.site1.com https://cloud.site2.com; connect-src https://cloud.site1.com; child-src 'self'");
    Platform.Response.SetResponseHeader("Referrer-Policy","strict-origin");
</script>

It's also possible for Site 2 to apply rules based on the Http Referrer header to disallow serving of assets in pages not hosted by Site 2 (see Apache's mod_rewrite).

1
  • Thanks @Macca this is a great answer, appreciate you taking the time!
    – Zucco
    Commented May 13, 2020 at 12:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .