How to configure a cloud page to be inaccessible to public in SFMC

Question

Currently, I have built a cloud page in SFMC that is being used for custom report.

Goal is to make it private / inaccessible to public so only SFMC users can access it.

Out of scope options:

• Private domain route is out of scope for us
• Restricting based on I.P is also not an option since it would not be feasible to get I.Ps for all users who are also using VPN

Looking for solution that simply allows SFMC users and do not authenticate anyone else outside (in public) to access the cloud page

I have explored this option posted here: https://sfmarketing.cloud/2021/08/09/securing-marketing-cloud-apps-hosted-on-cloudpages/

1. In Marketing Cloud, go to Setup > Apps > Installed Packages.
2. Click New.
3. Give the package a name and description.
4. Save the package.
5. Under Components, click Add Component, and select an API Integration component.
6. Under Integration Type, choose Web App and click next.
7. Under Redirect URIs, paste the link to the CloudPage that hosts your app.
8. The scope is not required, so leave all checkboxes blank. Save the package.

Then add the following code in cloud page HTML (& replacing the keys)

<script runat="server">

Platform.Load("core", "1");



var client_id = "xxxxx",        //add the client id from the installed package

    client_secret = "xxxxxx",    //add the client secret from the installed package

    subdomain = "xxxxx",        //add the 28 character subdomain (starts with mc….)

    redirect_uri = "xxxxx";     //add the url of the CloudPage that hosts your app



var auth = true;



var authToken = Platform.Request.GetCookieValue("authToken");

if (authToken == null) {

    var authCode = Request.GetQueryStringParameter("code");

    if (authCode == null) {

        Platform.Response.Redirect('https://&#39; + subdomain + '.auth.marketingcloudapis.com/v2/authorize?response_type=code&client_id=' + client_id + '&redirect_uri=' + redirect_uri);

    } else {

        var url = 'https://&#39; + subdomain + '.auth.marketingcloudapis.com/v2/token'

        var contentType = "application/json";

        var payload = {

            "grant_type": "authorization_code",

            "code": authCode,

            "client_id": client_id,

            "client_secret": client_secret,

            "redirect_uri": redirect_uri

        };

        try {

            var accessTokenRequest = HTTP.Post(url, contentType, Stringify(payload));



            if (accessTokenRequest.StatusCode == 200) {

                var tokenResponse = Platform.Function.ParseJSON(accessTokenRequest.Response[0]);

                var accessToken = tokenResponse.accessToken;

                Platform.Response.SetCookie("authToken", accessToken);

                auth = true;

            }



        } catch (error) {

            auth = false;

        }

    }

}

</script>

ERROR: With the above code, I am getting 500 server error on cloud page

Any advise?

Answer 1

Seems some characters (apostrophes) were converted to HTML character coding when you copied the script (https://&#39). Here’s the correct version:

<script runat="server">

Platform.Load("core", "1");



var client_id = "xxxxx",        //add the client id from the installed package

    client_secret = "xxxxxx",    //add the client secret from the installed package

    subdomain = "xxxxx",        //add the 28 character subdomain (starts with mc....xxxx)

    redirect_uri = "xxxxx";     //add the url of the CloudPage that hosts your app



var auth = true;



var authToken = Platform.Request.GetCookieValue("authToken");

if (authToken == null) {

    var authCode = Request.GetQueryStringParameter("code");

    if (authCode == null) {

        Platform.Response.Redirect("https://" + subdomain + ".auth.marketingcloudapis.com/v2/authorize?response_type=code&client_id=" + client_id + "&redirect_uri=" + redirect_uri);

    } else {

        var url = "https://" + subdomain + ".auth.marketingcloudapis.com/v2/token"

        var contentType = "application/json";

        var payload = {

            "grant_type": "authorization_code",

            "code": authCode,

            "client_id": client_id,

            "client_secret": client_secret,

            "redirect_uri": redirect_uri

        };

        try {

            var accessTokenRequest = HTTP.Post(url, contentType, Stringify(payload));



            if (accessTokenRequest.StatusCode == 200) {

                var tokenResponse = Platform.Function.ParseJSON(accessTokenRequest.Response[0]);

                var accessToken = tokenResponse.accessToken;

                Platform.Response.SetCookie("authToken", accessToken);

                auth = true;

            }



        } catch (error) {

            auth = false;

        }

    }

}

</script>

Sign up for free