5 results found

1. Enable Cloudflare's leaked credentials detection

   Please note: this idea required splitting so that various points may be addressed as information becomes available.

   New request:

   1. WAF compromised credentials check

   Original request:

   Please help with implementing below security features ASAP. There are so many frequent attacks on the website that causes the websites to go down.

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of specific countries (Challenge beyond the primary range/limit and block beyond the secondary range/limit)
   2. Basic Rate Limiting - Can we add a rule with rate limiting to block DoS attacks
   3. Bot Protection - Challenge suspected bots to confirm user authenticity
   4. Bot detection with javascript to identify headless browsers
   5. Captcha functionality - when users initially come into the site or users are starting an order or users are entering credit card information
   6. WAF compromised credentials check
   7. Any other WAF rules to protect the website from anonymous usage and attacks

   There are multiple problems if there are no proper security rules in place.

   • Problem-1: Websites are going down – Loss of business and sales
   • Problem-2: There are many unnoticed attacks, as we know the attacks only after the websites go down
   • Problem-3: There is a possibility of data mining from our websites if there is no security rules

   Please note: this idea required splitting so that various points may be addressed as information becomes available.

   New request:

   1. WAF compromised credentials check

   Original request:

   Please help with implementing below security features ASAP. There are so many frequent attacks on the website that causes the websites to go down.

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of specific countries (Challenge beyond the primary range/limit and block beyond the secondary range/limit)
   2. Basic Rate Limiting - Can we add a rule with rate limiting to block DoS attacks
   3. Bot Protection - Challenge suspected bots to confirm user… more
   5 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Delete…  ·  Admin →
   Building  ·  AdminNathan Brown (Technical Senior Product Manager, Optimizely) responded

   We are currently building support in CFG for Cloudflare for SaaS/O2O, which will allow customers to implement and maintain their own Cloudflare WAF in front of Optimizely's. If a customer chooses to stand up their own WAF, they would be able to tailor it to fit their business needs specifically by including things like rate limiting, bot protection, and other Cloudflare configurations.

   Note: Optimizely does already take action to mitigate attacks by working with the customer to implement challenges and/or specific rules for the issues the customer is experiencing.

2. Bot prevention measures

   Please note: this idea required splitting so that various points may be addressed as information becomes available.

   New request:

   1. Bot Protection - Challenge suspected bots to confirm user authenticity
   2. Bot detection with javascript to identify headless browsers
   3. Any other WAF rules to protect the website from anonymous usage and attacks

   Original request:

   Please help with implementing below security features ASAP. There are so many frequent attacks on the website that causes the websites to go down.

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of specific countries (Challenge beyond the primary range/limit and block beyond the secondary range/limit)
   2. Basic Rate Limiting - Can we add a rule with rate limiting to block DoS attacks
   3. Bot Protection - Challenge suspected bots to confirm user authenticity
   4. Bot detection with javascript to identify headless browsers
   5. Captcha functionality - when users initially come into the site or users are starting an order or users are entering credit card information
   6. WAF compromised credentials check
   7. Any other WAF rules to protect the website from anonymous usage and attacks

   There are multiple problems if there are no proper security rules in place.

   • Problem-1: Websites are going down – Loss of business and sales
   • Problem-2: There are many unnoticed attacks, as we know the attacks only after the websites go down
   • Problem-3: There is a possibility of data mining from our websites if there is no security rules

   Please note: this idea required splitting so that various points may be addressed as information becomes available.

   New request:

   1. Bot Protection - Challenge suspected bots to confirm user authenticity
   2. Bot detection with javascript to identify headless browsers
   3. Any other WAF rules to protect the website from anonymous usage and attacks

   Original request:

   Please help with implementing below security features ASAP. There are so many frequent attacks on the website that causes the websites to go down.

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of specific countries (Challenge beyond the primary range/limit and block beyond the… more
   11 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Delete…  ·  Admin →
   Building  ·  AdminNathan Brown (Technical Senior Product Manager, Optimizely) responded

   We are currently building support in CFG for Cloudflare for SaaS/O2O, which will allow customers to implement and maintain their own Cloudflare WAF in front of Optimizely's. If a customer chooses to stand up their own WAF, they would be able to tailor it to fit their business needs specifically by including things like rate limiting, bot protection, and other Cloudflare configurations.

   Note: Optimizely does already take action to mitigate attacks by working with the customer to implement challenges and/or specific rules for the issues the customer is experiencing.

3. Website Stability via Rate Limiting

   Please note: this idea required splitting so that various points may be addressed as information becomes available.

   New request:

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of specific countries (Challenge beyond the primary range/limit and block beyond the secondary range/limit)
   2. Basic Rate Limiting - Can we add a rule with rate limiting to block DoS attacks

   Original request:

   Please help with implementing below security features ASAP. There are so many frequent attacks on the website that causes the websites to go down.

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of specific countries (Challenge beyond the primary range/limit and block beyond the secondary range/limit)
   2. Basic Rate Limiting - Can we add a rule with rate limiting to block DoS attacks
   3. Bot Protection - Challenge suspected bots to confirm user authenticity
   4. Bot detection with javascript to identify headless browsers
   5. Captcha functionality - when users initially come into the site or users are starting an order or users are entering credit card information
   6. WAF compromised credentials check
   7. Any other WAF rules to protect the website from anonymous usage and attacks

   There are multiple problems if there are no proper security rules in place.

   • Problem-1: Websites are going down – Loss of business and sales
   • Problem-2: There are many unnoticed attacks, as we know the attacks only after the websites go down
   • Problem-3: There is a possibility of data mining from our websites if there is no security rules

   Please note: this idea required splitting so that various points may be addressed as information becomes available.

   New request:

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of specific countries (Challenge beyond the primary range/limit and block beyond the secondary range/limit)
   2. Basic Rate Limiting - Can we add a rule with rate limiting to block DoS attacks

   Original request:

   Please help with implementing below security features ASAP. There are so many frequent attacks on the website that causes the websites to go down.

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of… more
   6 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Delete…  ·  Admin →
   Building  ·  AdminNathan Brown (Technical Senior Product Manager, Optimizely) responded

   We are currently building support in CFG for Cloudflare for SaaS/O2O, which will allow customers to implement and maintain their own Cloudflare WAF in front of Optimizely's. If a customer chooses to stand up their own WAF, they would be able to tailor it to fit their business needs specifically by including things like rate limiting, bot protection, and other Cloudflare configurations.

   Note: Optimizely does already take action to mitigate attacks by working with the customer to implement challenges and/or specific rules for the issues the customer is experiencing.

4. Proactive Site Monitoring

   Opti should provide proactive site monitoring to its configured commerce customers. Customer should received an alert from Opti about server errors, hosting issues, site restarts, etc. As hosting provider, Opti should support the platform from this perspective and not be reliant on Partners or the Customers to address these types of errors.

   9 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Delete…  ·  Admin →
   Building  ·  AdminNathan Brown (Technical Senior Product Manager, Optimizely) responded

   This work is in progress across multiple areas of the product, including: Mission Control alerts/notifications, Cloudflare O2O support, proactive query analysis in CFG, and other performance improvements.

   
   

   Please see documentation around Mission Control's new Notifications tab - this is the main area where we will be including more alerts in the coming months: https://support.optimizely.com/hc/en-us/articles/44077180697997-Build-and-deploy-notifications

5. iFrame and Punchout integration

   Our punchout customers are requiring us to keep our punchout catalog in a frame within their procurements systems. We have been told that Optimizely does not support this functionality as it causes conflict with their authentication API. We ask that this be reviewed and an update put in place to support framing of the punchout catalog.
   The proposed work around was to "pop-out" the catalog. We do have the pop-out solution in place for our customers to access our catalog, but it is putting us in violation of their compliance requirements of our punchout. From one of our customers: "The behavior of the punchout is against our system policy and controls. Normally we would shut off catalogs with such non-compliant behavior. Alternate work arounds could be the move to a static catalog. "
   Based on feedback from our punchout customers (all on Ariba, the current fix in place is no longer "valid as a long-term solutions" as noted in the response from Epi from 2020. Moving to a static catalog creates a lot of manual work and reduces the use of our online catalog and is not the path we want to go down.
   Here is the previous stance from Epi:
   2/20/2020 Update
   Previously, we communicated that Episerver would provide an update to Epi B2B Commerce versions 4.5 and 4.6 to set SameSite cookies as "None; Secure" to allow the ability to render Epi B2B Commerce inside an iframe in some procurement platforms. After discussion with internal engineering team members and external PunchOut partners, including Punchout2Go, Supplier Solutions, and Greenwing, we decided not to proceed with these updates for the following reasons:
   • Epi B2B Commerce 4.5 and previous SDKs use .NET versions earlier than 4.7.2, which is the version needed to set this flag on SameSite cookies as "None; Secure", so it's not possible to issue a fix for these versions of the platform. Please see this article (https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fanswers%2Fquestions%2F6842%2Fannouncement-samesite-cookie-handling-and-net-fram.html&data=04%7C01%7Ckoliver%40vanmeterinc.com%7C460a3c4c8f164e4ade9208d9f61765e9%7C3a2dae894ea74356bcfe1042e1bebff4%7C1%7C0%7C637811402672043495%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=o06p3EhIJ26VF6%2Bcw2sPcHMlobL4lRGl59gOrCLehb0%3D&reserved=0 for information on the .NET Framework and how it handles SameSite cookies.
   • Episerver could update Epi B2B Commerce 4.6 to set SameSite cookies as "None; Secure", but this would impact the upcoming 5.0 release, which changes the way our commerce APIs authenticate. This new version of Epi B2B Commerce will use SameSite cookies, so setting these cookies to None, rather than Lax or Strict, would limit the functionality within our APIs.
   • All of Insite's PunchOut partners have solutions in place to solve for this issue, which doesn't require Episerver to perform further development or deployments.
   All Episerver PunchOut partners confirmed their fixes, which should already be implemented on your sites, are valid as long-term solutions. Episerver recommends reaching out to your PunchOut partner if you haven't done so yet.
   2/13/2020 Notice
   Google recently released Chrome 80, which changed how the browser handles cookies that are not secure with the SameSite=None attribute. This change may impact Epi B2B Commerce customers who integrate with PunchOut.
   If Epi B2B Commerce websites render in Iframes through procurement platforms like Ariba or Jaggaer, Chrome 80 will not save the users' cookies. Instead, Epi B2B Commerce renders as if users are not logged in, and they cannot successfully complete their PunchOut sessions.
   Episerver is working on updating Epi B2B Commerce Cloud and SDK versions 4.5 and 4.6 to set the flags Chrome 80 expects for secure cookies for websites rendered in Iframes. Until Episerver deploys this fix, we recommend reaching out to your PunchOut solutions partner. All of Episerver's certified PunchOut partners have workarounds for rendering Epi B2B Commerce within Iframes. The workarounds may impact your customers by rendering your Epi B2B Commerce website in a pop-up window rather than an Iframe, but their shopping experience should otherwise remain the same.
   Episerver will post another update indicating when we will deploy the fix for Epi B2B Commerce Cloud and SDK versions 4.5 and 4.6. We will also share how to fix this issue in earlier Epi B2B Commerce SDK versions.
   Note: We will be implementing a fix for supported versions lower than 4.5 in the near future.

   Our punchout customers are requiring us to keep our punchout catalog in a frame within their procurements systems. We have been told that Optimizely does not support this functionality as it causes conflict with their authentication API. We ask that this be reviewed and an update put in place to support framing of the punchout catalog.
   The proposed work around was to "pop-out" the catalog. We do have the pop-out solution in place for our customers to access our catalog, but it is putting us in violation of their compliance requirements of our punchout. From one of our customers: "The… more

   7 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Delete…  ·  Admin →
   Building  ·  AdminSara Winter (Principal Product Manager, Optimizely) responded

   Great news! We are working on adding a new PunchOut setting "Allow PunchOut in an iframe" and we anticipate this to be in the October 2026-sts release.

   
   

   We will provide another update once this work has been released with a link to the corresponding release notes.