I used the Engage JavaScript library on my website via the integration type "Client-side integration without tag management system". I am able to see all the guest and customer information in the CDP tool just fine. My question is what happens if a technical person can see the HTML source of a page and take the code and use on another website. My understanding is that it will result in unnecessary traffic loading into my CDP portal.

Is there any way to restrict the website domain in the CDP portal? In other words, can I configure Sitecore CDP to accept only visitors data from the domain www.abc.com and not other domains?

1 Answer 1


As far as I know, there is no such configuration to manage the domain (link to populate specific domain data only into CDP).

To me, your question is more about the security of your CDP details, which are being populated on a page using javascript engage JavaScript library.

There were cases where a secret should not be shared publicly. meaning someone can view any secrets stored within the application. In these cases, you’ll need to explore ways to hide the secrets. The best way is to create an orchestration/middleware/proxy layer to hide the secret. This could be built in the form of a server-side application or Serverless application (such as Azure Functions or AWS Lambda) to handle the Client Secret to protect it from malicious users. For an example of the proper way to handle this, Create a .Net Core application to handle the secret information and facilitate requests between the SPA application (rendering host) and the CDP tenant.

What to do if someone gains access?

If someone has gained access to your protected secrets for Sitecore CDP/Personalize, you should notify Sitecore support immediately and request a reset of your API Token. Once the reset has been completed, you’ll need to update all of your sources of ingestion/management of your tenant. But be careful during this process, to restrict access to only those that need it, and ensure you are not publicly making any secret information public.

Reference: Sitecore CDP/Personalize: Security Considerations when working with the APIs

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.