153 results found

1. Website User 'Approver' shows GUID value, not readable ID/name

   Website Users>Details show GUID in 'Approver' field, however, export of users correctly shows ID/name of the 'Approver'. As an administrator of user accounts, I need ability to see 'Approver' ID/Name on the user Details page, instead of requiring export of all users to view the identity of the Approver.

   •  

   17 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Gathering Feedback  ·  3 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

2. MFA/2FA for Admin Console Access Across All Domains

   Hi Team,

   Referring to tickets #1676413, #1498526, #1492633 and #1721382 —

   The Brasseler client is looking to enable multi-factor authentication (MFA) specifically for the admin account. Could you please confirm if this is supported by Optimizely?

   We reviewed the documentation provided for Set up multi-factor authentication, but it appears to apply at the Opti ID level, whereas the client is specifically looking for MFA enforcement at the admin account level and at Admin site. This request has come from their internal security team.

   We would appreciate your guidance on this.

   Thanks for your support.

   11 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Gathering Feedback  ·  2 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

3. Ability to force website users to sign in

   When Remember Me/Keep Me Signed In is enabled for the website, and the user selects the Remember Me/Keep Me Signed In option when signing into the Website, there is nothing that forces them to sign in again if their role has been changed. They can return to the website based on their cookies, even though their role has now been changed (example: from Buyer3 to Buyer1). As a result, they can place an order without approval.

   Please implement a function to force website users to sign in again when their role has been changed.

   5 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Gathering Feedback  ·  1 comment  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

4. Increase job's parameters to nvarchar(max)

   Increase job's parameters to nvarchar(max) so we can have larger values such as JSON. We are using custom properties to suit our needs, which is not the best approach.

   Tables:

   IntegrationJobParameter
   JobDefinitionParameter
   JobDefinitionStepParameter

   4 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   New  ·  0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

5. website users filteraccessible fields

   We need to show assigned customers and roles as column/exportable fields from the admin console. these fields could be delimited as possible multi value but currently cant access those fields at all without going into each individually

   3 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Gathering Feedback  ·  1 comment  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

6. Cloudflare WAF Rules

   Please help with implementing below security features ASAP. There are so many frequent attacks on the website that causes the websites to go down.

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of specific countries (Challenge beyond the primary range/limit and block beyond the secondary range/limit)
   2. Basic Rate Limiting - Can we add a rule with rate limiting to block DoS attacks
   3. Bot Protection - Challenge suspected bots to confirm user authenticity
   4. Bot detection with javascript to identify headless browsers
   5. Captcha functionality - when users initially come into the site or users are starting an order or users are entering credit card information
   6. WAF compromised credentials check
   7. Any other WAF rules to protect the website from anonymous usage and attacks

   There are multiple problems if there are no proper security rules in place.

   • Problem-1: Websites are going down – Loss of business and sales
   • Problem-2: There are many unnoticed attacks, as we know the attacks only after the websites go down
   • Problem-3: There is a possibility of data mining from our websites if there is no security rules

   Please help with implementing below security features ASAP. There are so many frequent attacks on the website that causes the websites to go down.

   1. Geographical Rate Limiting - Add rules with rate limiting for traffic outside of specific countries (Challenge beyond the primary range/limit and block beyond the secondary range/limit)
   2. Basic Rate Limiting - Can we add a rule with rate limiting to block DoS attacks
   3. Bot Protection - Challenge suspected bots to confirm user authenticity
   4. Bot detection with javascript to identify headless browsers
   5. Captcha functionality - when users initially come into the site or users are starting an order… more
   3 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   New  ·  0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

7. Prevent bot spamming logs

   We often see a lot of errors in the application logs related to bots spamming the website with URL requests that do not even exist, quite often these end in .php extension; example: https://[ConfiguredCommerceURL]/admin/function.php. These seem to be attacks that try to find vulnerabilities on the website. While often times these are harmless, they do pollute the application logs, making it harder for developers to find actual errors that are worth reporting. This feature request is to simply capture that kind of spam requests and simply block them, without processing anything else (these often come with errors such as 'Unity.Exceptions.InvalidRegistrationException' that arise from trying to find dependencies), upon finding out that the request is simply not valid as there should simply not exist any PHP resources on a Configured Commerce website, they should simply be blocked without actually logging an error. If we want to keep these maybe they should be logged somewhere else than the application logs so they could be more easily analyzed? maybe a list of these requests including the origin IP address.

   We often see a lot of errors in the application logs related to bots spamming the website with URL requests that do not even exist, quite often these end in .php extension; example: https://[ConfiguredCommerceURL]/admin/function.php. These seem to be attacks that try to find vulnerabilities on the website. While often times these are harmless, they do pollute the application logs, making it harder for developers to find actual errors that are worth reporting. This feature request is to simply capture that kind of spam requests and simply block them, without processing anything else (these often come with errors such as 'Unity.Exceptions.InvalidRegistrationException'… more

   10 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Research & Design  ·  1 comment  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

8. Request for an out of the box configuration setting for when sessions are fully expired

   Request for an out of the box configuration setting for when sessions are fully expired:

   • Session Expiration and let the client decide if they would like to redirect to Session Expired Page, or use Overlay with Session Expired Modal on same page.
   • In this setting we could also provide additional sub-setting with ability to enable a session expiration warning (admin can set the number of minutes)

   Incomplete Client-Side Inactivity Timeout: We have two different issues with this vulnerability,
   • If a customer steps away from their system without an automatic logout after a period of inactivity, there is a risk that others may access sensitive information. (They can’t take any action, however they can see all the information on that current page)
   • Customers believe they are still logged in while attempting to check out or submit orders, only to find themselves logged out unexpectedly. This can be frustrating for them.

   This issue was raised as a security vulnerability by security audit team and it’s also customer experience issue (they are not aware of session expiration). This is already in your tracker but it’s mentioned as “Working as Designed.” but it’s a security issue. Please consider this as a security fix.
   Incomplete Client-Side Inactivity Timeout Low When a user’s session expires, their active window is not redirected to a timeout or login page. Any information on the page remains exposed. Working as Designed. This is currently designed behavior on Storefront, any action on a website after session timeout will redirect user to SignIn page.

   Request for an out of the box configuration setting for when sessions are fully expired:

   • Session Expiration and let the client decide if they would like to redirect to Session Expired Page, or use Overlay with Session Expired Modal on same page.
   • In this setting we could also provide additional sub-setting with ability to enable a session expiration warning (admin can set the number of minutes)

   Incomplete Client-Side Inactivity Timeout: We have two different issues with this vulnerability,
   • If a customer steps away from their system without an automatic logout after a period of inactivity, there is… more

   6 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Gathering Feedback  ·  3 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

9. Control Panel Scheduler Must take Time Changes into account without re-scheduling jobs twice a year.

   1) Goals

   • Users can schedule jobs using their local date/time and time zone, and the job will run at the correct absolute instant even across DST and zone changes.
   • This must take into account Daylight Savings time changes in the Spring and Fall
   • The current Opti control panel only allows one time zone to be used (UTC). Need the ability to handle more than one.
   • User should not have to manually re-schedule jobs two times per year when clocks change
   • Admins and integrators can display and manage schedules in any time zone, and any time circumstance.

   2) Functional Requirements

   2.1 Scheduling (User flows)
   • Allow user to pick:
   o Local date (YYYY-MM-DD)
   o Local time (HH:MM)
   o Time zone (IANA with search/autocomplete)
   • Display converted times prominently (Local user view, Tenant admin view, and UTC).
   • Allow recurring schedules with explicit interpretation rules

   3) UI behavior
   • When user selects a time zone, display both the local selected time and the equivalent UTC and the viewer’s local time.
   • Warn users during DST transition windows (scheduling into the "missing hour" or ambiguous hour) and require confirmation/explicit selection where ambiguity exists.
   • Provide a toggle to show times in: “Viewer local”, “Scheduler’s zone (stored)”, and “UTC”.

   4) Edge Cases & DST handling
   • Ambiguous times (fall-back hour): e.g., in many zones 01:30 occurs twice. Require user to choose “first” or “second” occurrence or explicitly pick UTC offset to disambiguate. Persist which one was chosen.
   • Non-existent times (spring-forward): e.g., 02:30 may not exist. Offer to:
   o Shift to the next valid instant, or
   o Ask user to pick an explicit offset, or
   o Reject and request different time — UI should explain.
   • Time zone rule changes after schedule creation: If a zone's rules change (government changes DST), previously computed UTC times might shift.
   • Options:
   o Recompute next occurrences dynamically at runtime using the current tzdb (and record changes), or
   o Freeze behavior to the tzdb version at creation (store tzdatabaseversion) and only change after administrative approval. (Prefer dynamic recompute for user expectations, but keep audit trail.)
   • Cross-tenant or cross-user views: always display a note when converting times indicating which tz rules were used and show both local and UTC values.

   ---

   5) Scheduler / Execution design
   • Scheduler service runs in UTC. Jobs are queued for the exact scheduledatutc.
   • For recurring jobs, a separate recurrence manager:
   o When a run completes (or is consumed), compute and persist the next run(s) in UTC.
   o Optionally precompute N future runs to reduce runtime computation and to detect DST/ambiguity early.

   ---

   6) API & Client guidance
   • Clients must send the IANA tz id when scheduling. If omitted, reject with an error (no implicit server-local timezone).
   • Provide a time zone autocomplete endpoint (GET /api/time zones ?q=Chicago) powered by a canonical list from tzdata.
   • Provide helper endpoints for preview:
   o POST /api/schedules/preview — returns UTC instant(s), localized displays for multiple viewer zones, and any DST warnings.

   1) Goals

   • Users can schedule jobs using their local date/time and time zone, and the job will run at the correct absolute instant even across DST and zone changes.
   • This must take into account Daylight Savings time changes in the Spring and Fall
   • The current Opti control panel only allows one time zone to be used (UTC). Need the ability to handle more than one.
   • User should not have to manually re-schedule jobs two times per year when clocks change
   • Admins and integrators can display and manage schedules in any time zone, and any time… more

   2 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   New  ·  0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

10. Better extensibility options for Search V2 Indexing

    We have a requirement on our project that requires us to change the behavior of the search indexing v2. In trying to do so, our development team ran into an issue where the class we needed to extend was not extensible (internal, sealed, or non overrideable methods).

    Basically what we are trying to do is remove the condition that excludes child products when fetching indexable products that is in line 896 of class Insite.Search.Shared.DocumentTypes.Product.Index.SearchV2.Models.Product (this is in version 5.2.2412.1705)

    What we would like to see changed is:

    1 - Make the SearchV2.Models.Product public instead of internal and remove the sealed keyword (and do the same for other classes in the SearchV2 and SearchV2.Models namespaces)

    2 - If possible, move the lines from 893 to 904 to a virtual method so we can override it - specifically this code:

    var indexableProducts = products
    .Except(inactiveStyleParents)
    .Where(p =>
    p.StyleParentId is null
    && (
    !p.IsDiscontinued
    || (productIdsWithQuantityOnHand.Contains(p.Id) && p.TrackInventory)
    )
    && p.IsActive
    && p.IndexStatus != 2
    )
    .ToArray();

    And it's not really just about this particular piece of code - in that class the entire ReadFromDatabase method has a lot of logic in it, is there any way to break some of that apart into virtual methods, or handler chains / pipelines and make it extensible?

    3 - Make the constructor of class Insite.Search.Shared.DocumentTypes.Product.Index.SearchIndexableProduct public instead of internal

    Without these extension points, we are currently forced to copy / paste a lot of classes from base code, and slightly modify a few of them, in order to achieve the desired functionality. Attached is a screenshot from our pull request showing all of the files we had to copy - the only ones we actually change are the ones highlighted in red.

    And again, this is not just about our specific requirement, but more of a request to open the entire Search V2 Indexing architecture to be more extensible. Right now it's pretty "locked down"

    We have a requirement on our project that requires us to change the behavior of the search indexing v2. In trying to do so, our development team ran into an issue where the class we needed to extend was not extensible (internal, sealed, or non overrideable methods).

    Basically what we are trying to do is remove the condition that excludes child products when fetching indexable products that is in line 896 of class Insite.Search.Shared.DocumentTypes.Product.Index.SearchV2.Models.Product (this is in version 5.2.2412.1705)

    What we would like to see changed is:

    1 - Make the SearchV2.Models.Product public instead of internal and remove the sealed… more

    •  

    7 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Gathering Feedback  ·  1 comment  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

11. PIM - User Roles Don't Work

    Optimizely confirmed the existing PIM roles do not work but asked me to enter it as feedback instead of a bug. A user must be an Admin to update an image, which is not optimal. There are existing PIM roles with Edit permissions for items and images, but they do not work. Fix the existing roles, or custom roles and permission so a user doesn't have to have full admin authority to edit an image or an item field.

    2 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Committed  ·  1 comment  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

12. Many customers change their SKU and it's not really supported in Configured Commerce

    We have several client which rename SKUs in their ERP instead of deactivating and create a new one for multiple reasons. Recently one of them ask us to create a "Master UID" for them to map and update our products, but this field is internal only and not visible to the customers, so it's an internal ID used between the ERP, PIM and Configured Commerce to update the product.

    Can such a field be added and could be used as an alternate natural key to simplify everything? Seems to us like a common issue.

    2 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    New  ·  0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

13. Add the ability to grant impersonate permissions to custom roles

    I want to be able to create a custom role for the admin console users that while given limited permissions through the Application Dictionnary would also be granted the ability to impersonate website users. Currently, the impersonate feature is limited to 4 roles: ISCSystem, ISCImplementer, ISCAdmin, ISCUser. Being able to customize the CanCurrentUserImpersonateAnotherUser method used by the AccountController would give more flexibility.

    5 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    3 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating
    Research & Design  ·  AdminFilip Åström (Product Manager, Optimizely) responded

    Our development team is currently working on this item, and it’s likely to be added to the roadmap soon - pending any technical challenges

14. Optimize Wishlist Updates: Refresh Line Item Only, Not Entire Page

    Optimize Wishlist Updates: Refresh Line Item Only, Not Entire Page.

    Current Behavior (for customers using live inventory and price via API):
    In Configured Commerce, when a user updates a product within a list or quote (e.g., changing quantity or removing an item), the entire list page refreshes. This results in longer load times and a less efficient experience, particularly for large lists.

    Requested Enhancement:
    Modify list/quote functionality so that updates apply only to the specific line item being changed, rather than forcing a full list refresh (must also adjust the product total). Ideally, this would be handled via an asynchronous update (API call / AJAX request) that re-renders just the affected line item instead of all items in the list/quote.

    Business Impact:

    Enhances customer experience by making lists more responsive and user-friendly

    Especially beneficial for B2B users managing long or complex lists

    Outcome:
    A smoother, faster, and more modern list interaction that aligns with best practices seen in cart and order management on other eCommerce platforms.

    Optimize Wishlist Updates: Refresh Line Item Only, Not Entire Page.

    Current Behavior (for customers using live inventory and price via API):
    In Configured Commerce, when a user updates a product within a list or quote (e.g., changing quantity or removing an item), the entire list page refreshes. This results in longer load times and a less efficient experience, particularly for large lists.

    Requested Enhancement:
    Modify list/quote functionality so that updates apply only to the specific line item being changed, rather than forcing a full list refresh (must also adjust the product total). Ideally, this would be handled via an asynchronous… more

    2 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating
    Gathering Feedback  ·  AdminSara Winter (Principal Product Manager, Optimizely) responded

    Thank you for submitting this request! Currently in order to handle the complexity of keeping the data consistency between the My List Details and My Lists Page(s) across the wide customer base we require resetting the state after updates on the line item(s) within Lists.

    
    

    While we do not have any changes planned to alter this behavior on base please feel free to continue sharing feedback and impact.

15. Send order confirmation as pdf attachment

    Our customers want to receive their order confirmations as a PDF attachment. Many still want to print them, attach a digital copy to their ERP, or save a digital copy. PDF's make this much easier.

    Many won't order online since they don't like the order confirmations. Others require us to manually send a PDF version out of our ERP after they have placed their order.

    2 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating
    Gathering Feedback  ·  AdminSara Winter (Principal Product Manager, Optimizely) responded

    Thank you for submitting this request! Our team is currently reviewing this feature, particularly with consideration of our wide client base. We will update this ticket once we have completed this investigation.

16. Order checkout rules

    We received requests from several customers that their business required users to fulfill certain conditions before they can checkout. For example:
    - Minimum order amount.
    - Shipping carrier is required.

    Please implement the capability of creating checkout rules to provide customers with controls over their incoming orders.

    2 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating
    Gathering Feedback  ·  AdminSara Winter (Principal Product Manager, Optimizely) responded

    Thank you for submitting this request! We have added this item to our backlog for future consideration and prioritization.

    
    

    If there are more details regarding the desired experience for these storefront customers who do not meet the rules that would also be appreciated.

    
    

    Would there be a goal to encourage users to shop their MyLists or have selection of recommended products for example or would the desire be to simply disable the ability to checkout with appropriate messaging as to the rule that needs to be met to continue?

17. HTTP Security header support

    We need the Optimizely platform to support the following HTTP security response headers:

    -Permissions-Policy

    -Content-Security-Policy

    These headers are essential for instructing browsers on how to handle website content securely. They enhance overall security by enforcing specific rules, such as preventing cross-site scripting (XSS) and clickjacking attacks.

    Our cybersecurity provider is now requiring that these policies be implemented on all public-facing web servers. As such, support for these headers is a critical requirement moving forward.

    Please advise on the platform’s capability to support and configure these headers.

    •  

    2 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    2 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating
    Gathering Feedback  ·  AdminSara Winter (Principal Product Manager, Optimizely) responded

    This change request would increase the risk of site failures occurring if the CSP/header size is too large and require detailed review to help ensure proper guardrails exist.

    
    

    We have added this item to our backlog for future consideration and prioritization.

18. Add Custom Field Names as Filter and Column in Customer Selection Pop-up (Admin Console)

    We would like to request an enhancement to the Customer Selection pop-up within the Admin Console—specifically when assigning customers to users. This is for the Configured Commerce product.

    Current Behavior:
    Currently, the Customer Selection interface only allows filtering and viewing based on standard fields (e.g., customer name, ID, etc.). Custom fields that have been defined are not available as filter options or visible columns in the selection grid.

    Requested Enhancement:

    Add the ability to filter by custom field values in the Customer Selection pop-up.

    Add the option to include custom fields as visible columns in the grid view to aid in customer identification and selection.

    Business Impact:
    This enhancement would streamline the process of assigning customers to users, especially in cases where there are a large number of customers and custom attributes are critical for segmentation. It would significantly improve usability for admin users managing complex customer hierarchies or permission models.

    Use Case Example:
    An admin managing customer-user assignment can more easily assign customers based on a custom field rather than searching by customer name or ID.

    Thank you for considering this enhancement!

    We would like to request an enhancement to the Customer Selection pop-up within the Admin Console—specifically when assigning customers to users. This is for the Configured Commerce product.

    Current Behavior:
    Currently, the Customer Selection interface only allows filtering and viewing based on standard fields (e.g., customer name, ID, etc.). Custom fields that have been defined are not available as filter options or visible columns in the selection grid.

    Requested Enhancement:

    Add the ability to filter by custom field values in the Customer Selection pop-up.

    Add the option to include custom fields as visible columns in the grid view to aid… more

    3 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating
    Gathering Feedback  ·  AdminSara Winter (Principal Product Manager, Optimizely) responded

    Thank you for submitting this request! Our team is currently reviewing if and how we may implement this enhancement to filtering within the Admin Console, particularly with consideration of our wide client base. We will update this ticket once we have completed this investigation.

19. Inherit Product Assignments in Category Hierarchy for Rule Engine

    Current Behavior: In Optimizely, products are currently assigned only to the most specific (end-node) category within a 3-level taxonomy.
    For example, if the category tree is:

    Power Tools > Drills > Cordless Drills

    Then a product like a cordless drill is assigned only to the "Cordless Drills" category, and not to "Drills" or "Power Tools".

    Problem: This structure causes significant limitations when using the rule engine—specifically the “Product In Category” rule. Since products are not assigned to higher-level categories, those categories cannot be used effectively in rules.

    This creates a major pain point when building dynamic catalog restriction groups. Users are forced to assign rules at the lowest-level categories, resulting in excessive manual configuration and a time-consuming setup process.

    Proposed Enhancement: Enable category inheritance within the rule engine so that:

    If a product is assigned to a subcategory, it is implicitly considered part of all its parent categories.

    Rules applied to a higher-level category should automatically include products assigned to any of its descendant categories.

    Benefits:

    Significantly reduces the time and complexity required to build and maintain catalog rules.

    Makes the rule engine more intuitive and aligned with how category hierarchies are conceptually structured.

    Improves scalability and efficiency for merchandisers and admins managing large product catalogs.

    Current Behavior: In Optimizely, products are currently assigned only to the most specific (end-node) category within a 3-level taxonomy.
    For example, if the category tree is:

    Power Tools > Drills > Cordless Drills

    Then a product like a cordless drill is assigned only to the "Cordless Drills" category, and not to "Drills" or "Power Tools".

    Problem: This structure causes significant limitations when using the rule engine—specifically the “Product In Category” rule. Since products are not assigned to higher-level categories, those categories cannot be used effectively in rules.

    This creates a major pain point when building dynamic catalog restriction groups. Users… more

    5 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating
    Research & Design  ·  AdminFilip Åström (Product Manager, Optimizely) responded

    Thank you for submitting this request! We have added this item to our roadmap. Although we cannot guarantee a release date, we expect this feature to be available within the next 12 months.

20. Reintroduce or Provide Alternative Method to Restrict Access to the Admin Console in Configured Commerce (V3)

    As part of our recent internal security audit, we identified a vulnerability related to unrestricted access to the Optimizely Configured Commerce Admin Console.

    In the legacy V1 architecture, administrators could restrict Admin Console access by domain or IP range using configuration updates (as described in the Optimizely documentation: https://docs.developers.optimizely.com/configured-commerce/docs/restricting-access-to-admin). However, in the V3 architecture, this capability is no longer supported or configurable within the managed environment.

    Our support engagement (Ticket #1788512) confirmed that this feature was not migrated to V3 due to complications with the impersonation feature and has since been deprecated. As a result, customers currently have no configuration-based control over Admin Console access restrictions.

    We request an enhancement to reintroduce or provide an alternative mechanism for controlling and limiting access to the Admin Console, ideally at the domain, IP, or network level.

    As part of our recent internal security audit, we identified a vulnerability related to unrestricted access to the Optimizely Configured Commerce Admin Console.

    In the legacy V1 architecture, administrators could restrict Admin Console access by domain or IP range using configuration updates (as described in the Optimizely documentation: https://docs.developers.optimizely.com/configured-commerce/docs/restricting-access-to-admin). However, in the V3 architecture, this capability is no longer supported or configurable within the managed environment.

    Our support engagement (Ticket #1788512) confirmed that this feature was not migrated to V3 due to complications with the impersonation feature and has since been deprecated. As a result, customers currently have no… more

    1 vote

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    New  ·  0 comments  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating