SAP Marketing Cloud write interactions via JavaScript from external Website

[former_member307928]

Hello,

we are facing difficulties with writing interactions from external website into SAP Marketing Cloud. Due to archtectural reasons, we cannot implement a server-side class to send the interactions as described in the documentation (and recommended) to send over the intractions to SAP Marketing Cloud. So after several analyses we came to the point the only solution for this specific case is to write the interactions directly from JavaScript Code. However, the Sandbox Security (Browser-Side / CORS) does not allow this. For this some HTTP headers within SAP Marketing Cloud have to be set which seems we are not able to. Is there any possiblity to do that?

Best

Dominic

[former_member474669]

Dear, actually using a call via JS is not the best scenario, due to several security flaws. Ideally, you should use API Management or build an integrator in Java or C # more securely. If you use JS, try using some libraries to obfuscate and protect the code.

May the force be with us

#JEDICRM

[rolf_schumann]

Hi Dominic,

It’s difficult to provide a blanket answer to that. If it is a website that is accessible to the public, our experts would strongly advise against sending OData requests to the backend using JavaScript. Doing so makes it possible for anyone to send manipulated requests, especially since anonymous users either then have credentials or don’t need them anymore.

If the website is considered a secure context, i.e. on a private network or accessible via login, it could be done, but with some difficulty. Assumedly you would have to use a reverse proxy to call the SMC system with the same URL as the actual website.

In general, we would advise against it and suggest again using a server side integration instead.

Best regards,

Rolf Schumann

[former_member307928]

Hi Anton,

we have already validated the relevant issues and for this specific purpose other methods to secure the approach will be taken into account. So we are at this point after several investigations stuck with this approach.

Cheers,

Dominic

[Former Member]

Hi shounak.deshpande , can you run a validation on the security related question above?

I do not agree with the approach, since JS script injection is usually used for bad purposes. Anyways, I am not an security expert and a quick validation would be nice.

Thanks, Anton