241 results found

1. Official guidance for HTTP QUERY method support in Optimizely DXP

   Summary

   The HTTP QUERY method (RFC 10008) provides a standardized way to perform safe, idempotent query operations while allowing a request body, addressing a long-standing limitation of GET.

   https://www.rfc-editor.org/info/rfc10008/

   https://tykok.medium.com/the-new-http-method-query-d1dc3efc35c4

   While ASP.NET Core applications can implement support for QUERY, developers deploying to Optimizely DXP also depend on the surrounding platform and infrastructure.

   Request

   Could Optimizely publish official guidance regarding support for the HTTP QUERY method in DXP?

   Specifically, it would be helpful to clarify:

   • Is QUERY currently supported throughout the DXP infrastructure?
   • If not, which components prevent support (Cloudflare, WAF, load balancers, Azure App Service, proxies, etc.)?
   • Are there any security considerations specific to QUERY that developers should be aware of?
   • Will QUERY be treated similarly to GET regarding safe/idempotent semantics where applicable?
   • Is support on the product roadmap, or is it considered out of scope?
   • If there is no current support, what is the recommended approach for developers who would otherwise benefit from QUERY?

   Why this matters

   Many APIs expose complex search and filtering operations that naturally fit a safe, idempotent request but exceed the practical limitations of GET query strings.

   The QUERY method provides a standards-based solution to this problem. As more frameworks begin supporting it, developers will naturally want to know whether Optimizely DXP fully supports the method before adopting it.

   Even if official support is not yet planned, having clear documentation describing the current state and any platform limitations would help developers make informed architectural decisions.

   Thank you for considering publishing official guidance.

   Summary

   The HTTP QUERY method (RFC 10008) provides a standardized way to perform safe, idempotent query operations while allowing a request body, addressing a long-standing limitation of GET.

   https://www.rfc-editor.org/info/rfc10008/

   https://tykok.medium.com/the-new-http-method-query-d1dc3efc35c4

   While ASP.NET Core applications can implement support for QUERY, developers deploying to Optimizely DXP also depend on the surrounding platform and infrastructure.

   Request

   Could Optimizely publish official guidance regarding support for the HTTP QUERY method in DXP?

   Specifically, it would be helpful to clarify:

   • Is QUERY currently supported throughout the DXP infrastructure?
   • If not, which components prevent support (Cloudflare, WAF, load balancers, Azure App Service, proxies, etc.)?
   • Are there any… more
   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   New  ·  1 comment  ·  DXP, Hosting & Infrastructure  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

2. Support Newer .NET WebApplicationBuilder

   I would like to use the newer WebApplicationBuilder / IHostApplicationBuilder introduced in .NET 6 to initialize the CMS instead of the .NET Core 3 method of using IHostBuilder, because .NET Aspire does not support IHostBuilder. The ConfigureCmsDefaults method does not support WebApplicationBuilder, and even though the following code will compile, the CMS is not usable:

   var builder = WebApplication.CreateBuilder(args);
   builder.Host.ConfigureCmsDefaults();

   6 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   New  ·  0 comments  ·  Implementation  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

3. Computed fields in Contracts

   Role: Developer working with Optimizely CMS 13 and Optimizely Graph.

   Problem:
   I am implementing search across multiple content types (pages, media etc.) using Optimizely Graph.
   A common requirement is to expose consistent search fields across different content types, for example SearchTitle and SearchDescription, while allowing each content type to derive those values from its own properties and fallback logic.

   The current limitation is that computed fields cannot be exposed through Contracts. While computed fields can be defined on concrete content types and avoid storing redundant search data, they cannot be used to create a unified schema across multiple content types.

   For search scenarios, fields such as SearchTitle and SearchDescription are really search projections rather than editor-managed content. To expose these fields through a Contract today, they must be persisted in the content model, even though they are derived projections rather than actual content.

   Desired outcome:
   Ideally, it should be possible to create a unified search schema backed by computed fields, without having to persist derived values in the content model.
   This would allow developers to expose consistent search fields across pages, media and other content types while keeping the content model free from search-specific properties and publish-time population logic.

   Role: Developer working with Optimizely CMS 13 and Optimizely Graph.

   Problem:
   I am implementing search across multiple content types (pages, media etc.) using Optimizely Graph.
   A common requirement is to expose consistent search fields across different content types, for example SearchTitle and SearchDescription, while allowing each content type to derive those values from its own properties and fallback logic.

   The current limitation is that computed fields cannot be exposed through Contracts. While computed fields can be defined on concrete content types and avoid storing redundant search data, they cannot be used to create a unified schema across multiple content types.

   … more

   2 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   New  ·  0 comments  ·  Graph  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

4. Dynamic Scaling in DXP - improve performance and reduce costs

   The default hardware SKU for Optimizely is P1V3. P1V3 only has 2 cores and P2V3 has 4 cores. Because the number of cores available to the system dictates the number of default threads the system attempt to regulate, it would be best to deviate away from our current default hardware SKU, P1V3 to P2V3, instead. However, doing so would increase costs which we do not want to do necessarily. This is a proposal to decrease costs while simultaneously increasing hardware resources during peak hours.

   The idea is to increase a customer's lower environment hardware to P2V3 during "working hours" (to be defined by the area the company hosts their hardware in by default), then decrease it after hours.

   The result would be to decrease hardware down to a minimum between approximately 5pm and bump it up again at approximately 9am. But, bump it up to a higher SKU that enables them to operate faster and better

   Based on my calculations, it appears that we could save approximately $700k/yr in doing so (calculation based on retail prices, not contracted prices).

   See the attached spreadsheet for projected reduction in costs.

   A self-service ability would be necessary to be able to temporarily scale up hardware resources. For example:

   • The user would have the ability to push a button to scale up to P2V3 if between an extended hour (between 7am and 7pm).

   • The user would have the ability to scale up additional instances for a short window of time and to keep hardware scaled to P2V3 for, say 4 days per month (4 days of load testing for example).

   This would enable the partner/customer development team to have better control over their resources while simultaneously dropping our costs another $500k-700k approximately.

   The default hardware SKU for Optimizely is P1V3. P1V3 only has 2 cores and P2V3 has 4 cores. Because the number of cores available to the system dictates the number of default threads the system attempt to regulate, it would be best to deviate away from our current default hardware SKU, P1V3 to P2V3, instead. However, doing so would increase costs which we do not want to do necessarily. This is a proposal to decrease costs while simultaneously increasing hardware resources during peak hours.

   The idea is to increase a customer's lower environment hardware to P2V3 during "working hours" (to… more

   • 

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Gathering Feedback  ·  2 comments  ·  DXP, Hosting & Infrastructure  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

5. Add page or block deletion to approval workflow

   My role: Expert Service Application Engineer.

   We’re working on adding a deletion workflow similar to the existing approval workflow.
   Outcome: We need the ability to configure an approval process not only for publishing content, but also for deleting it.

   8 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Gathering Feedback  ·  1 comment  ·  Approval & Collaboration  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

6. Customer Feedback: Improve CMS UI visibility for Optimizely Graph synchronization status

   I am a Technical Support Engineer submitting this feedback on behalf of a customer. The customer is using Optimizely CMS and relies on Optimizely Graph to synchronize content between the CMS and the search index.

   Currently, the CMS shows synchronization status only under the Options menu. The text labels such as "Not changed since last publish" or "Synchronize with Optimizely Graph" are not visually prominent. Editors cannot quickly determine whether a page is already synchronized, out of sync, or requires re-synchronization. This makes it difficult for editors to know the current state of content without navigating menus.

   The customer suggests a simple, clear visual indicator directly in the CMS interface. This could include:

   A visible text label and icon indicating the synchronization status.

   Examples of visual indicators:

   ❌ Not synchronized or out of date

   ✅ Synchronized or up to date

   This would help editors quickly understand the current synchronization state.

   I am a Technical Support Engineer submitting this feedback on behalf of a customer. The customer is using Optimizely CMS and relies on Optimizely Graph to synchronize content between the CMS and the search index.

   Currently, the CMS shows synchronization status only under the Options menu. The text labels such as "Not changed since last publish" or "Synchronize with Optimizely Graph" are not visually prominent. Editors cannot quickly determine whether a page is already synchronized, out of sync, or requires re-synchronization. This makes it difficult for editors to know the current state of content without navigating menus.

   The customer suggests… more

   •  

   3 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   2 comments  ·  Graph  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating
   Gathering Feedback  ·  AdminCiara Bergin (Principal Product Manager, Optimizely) responded

   We’re currently gathering additional feedback on this idea. If you have any more context, examples, or specific use cases, please share them - it really helps us understand how this would best support your workflow. Thanks for contributing to the conversation!

7. Allow copying the original value for Non-CultureSpecific fields inside Culture Specific list properties during auto-translate operation

   For some blocks we use list properties and define them as Culture Specific. And if there is a non-culture specific field inside the list item block type, the value is not copied or translated due to the implementation in EpiServer code.

   For this case we need to find a way to copy the original value from the master language branch while translating the content. Please add a feature to customize this behavior.

   Thanks.

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   New  ·  0 comments  ·  Translations  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

8. Support keeping the original values for technical fields during auto-translate

   We have a culture specific string field in one block type which is decorated by custom "AutoSuggestSelection" attribute. The attribute allows us to select predefined list of icon types. The problem we face is that the field is a technical field which should not be translated. Even possible it should be copied from the master language. But translation provider automatically translates the field value if it is string and culture specific.

   Please add an option for skipping/copying technical fields during auto-translate operation

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   New  ·  0 comments  ·  Translations  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

9. Add .NET Counter publication to App Insights on Startup

   There are a whole suite of .NET counters available to use to publish to App Insights. This is a low-lift modification that enables us to gain many insights, directly inside of App Insights Metrics, we can utilize to diagnose issues on customers.

   This enables us to do performance investigations that otherwise require manual intervention (such as downloading .ETL files and opening them in PerfView or capturing dump files and analyzing them).

   We can skip these manual steps and jump write to "close to root causes" by publishing this information. There is little cost and no significant performance degradation associated with publishing this information because Microsoft has designed these metrics to be high performance to collect.

   Having this information available to us enables us to build further features such as success metrics into dashboards for partners to gauge the success of their implementation by taking this information and other information we've build into the Dashboard and surfacing it up in a useful way to the user base.

   There are a whole suite of .NET counters available to use to publish to App Insights. This is a low-lift modification that enables us to gain many insights, directly inside of App Insights Metrics, we can utilize to diagnose issues on customers.

   This enables us to do performance investigations that otherwise require manual intervention (such as downloading .ETL files and opening them in PerfView or capturing dump files and analyzing them).

   We can skip these manual steps and jump write to "close to root causes" by publishing this information. There is little cost and no significant performance degradation associated with… more

   • 

   2 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Gathering Feedback  ·  0 comments  ·  DXP, Hosting & Infrastructure  ·  Delete…  ·  Admin →
   How important is this to you?

   Nice to have You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

10. HSTS on the root domain

    We are experiencing some redirection issues we have no control over as they are done in the root domain.

    http://oldsite.com redirects to https://www.oldsite.com then finally to https://www.newsite.com

    The redirection should be as follows:

    http://oldsite.com -> https://oldsite.com -> https://www.newsite.com

    Please update Optimzely’s configuration to do these redirects properly

    30 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Gathering Feedback  ·  4 comments  ·  DXP, Hosting & Infrastructure  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

11. IQI Report - App Insights as the Source of Truth

    There are multiple similar functions happening that are similar within Optimizely. They all need to be utilizing the same data a the singular source of truth. They are:

    1. Incident Management, primary data is App Insights.

    2. Deep diagnostics done by Problem Management, primary data is App Insights

    3. App Insights Dashboard

    4. IQI Health Check reporting, primary information (aside from pingdom's availability info which for legal reasons) is Cloud Flare for health information.

    The inconsistency of source data causes issues because we cannot make a consistent presentation of the information when the source being utilized is entirely different.

    It also adds possibility of deviation of information because CloudFlare adds network hops and the possibility of transforming HTTP Status Codes, etc. So, the information can be altered in an unproductive way.

    If we want to add CloudFlare reporting, we should add targeted CloudFlare specific reports to the IQI report. These should identify discrepancies within the CloudFlare environment that are frequently done as differentials between App Insights and CloudFlare - such as delays in response from CloudFlare that are not caused by backend systems.

    There are multiple similar functions happening that are similar within Optimizely. They all need to be utilizing the same data a the singular source of truth. They are:

    1. Incident Management, primary data is App Insights.

    2. Deep diagnostics done by Problem Management, primary data is App Insights

    3. App Insights Dashboard

    4. IQI Health Check reporting, primary information (aside from pingdom's availability info which for legal reasons) is Cloud Flare for health information.

    The inconsistency of source data causes issues because we cannot make a consistent presentation of the information when the source being utilized is entirely different.

    It also adds possibility of… more

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Gathering Feedback  ·  1 comment  ·  DXP, Hosting & Infrastructure  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

12. CMS Page Previews

    When previewing unpublished pages in the CMS, nested blocks (such as unpublished child blocks within a parent block) do not display correctly at the page level, making it impossible for publishers to see the full layout and content as it will appear when published. This limitation forces the team to rely on the Advanced Review plugin, which does show all nested unpublished content but introduces extra steps and performance issues.

    12 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Gathering Feedback  ·  2 comments  ·  Editing (Content)  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

13. Allow setting Title to tinyMCE video element (WCAG A level requirement)

    Content creator currently cannot set title to tinyMCE video element which means it breaks the WCAG A level requirement: https://www.w3.org/WAI/WCAG21/Understanding/non-text-content.html

    tinyMCE can be overridden to allow custom attributes including title but it would need content creator to understand application code in order to apply the value

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    New  ·  0 comments  ·  Editing (Content)  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

14. Editor Content Health Dashboard : A personalized, self-service governance view for every content editor in the CMS

    As a content editor, I want to see a personalized dashboard when I log in to the CMS that shows me only the content I own that needs attention, so that I can find and fix issues myself, without waiting for someone else to tell me about them.

    This dashboard replaces the generic default view in the CMS for all content editors. It does not replace any existing admin tools or reports. The intent is to move content governance from a reactive, admin-led activity into a proactive, editor-led habit. The dashboard is the trigger for that behavioural shift. This is a single story that covers the concept and requirements. If the team needs to break it into smaller stories per dashboard section for sprint planning, that is a valid approach, but the sections should be built as one coherent interface, not as separate standalone tools.

    The problem we are solving
    Today, the CMS shows every editor the same generic dashboard. It is not personalized, it does not show issues specific to that editor's content, and it gives no signal about whether the content they own is healthy or broken. The result is that content problems, broken links, outdated pages, unused media, unpublished drafts, go unnoticed for months or even years, until an admin, a customer complaint, or a site audit surfaces them. By that point the damage is already done.
    With over 100 editors across our sites, we cannot rely on a central team or a CMS administrator to track and chase every editor about their content. That model does not scale. Governance needs to become a personal responsibility and for that to happen, editors need to be able to see their own issues at a glance the moment they log in.

    Who this is for
    This dashboard is for every person who creates, edits, or publishes content in the CMS. That includes marketing editors, regional content managers, product page owners, and campaign managers. It is not a tool for administrators - it is a tool that makes every individual editor their own first line of quality control.

    What the editor needs to see
    When an editor logs in, their dashboard should surface the content they personally created or own. (as per editor access rights applicable)

    Broken and 404 pages
    1. Pages I created that are currently returning a 404 error or are broken
    2. Pages that have an incorrect redirect set up
    3. Any pages I own that have no live URL and no redirect in place
    4. Direct links to each page so I can go in and fix it immediately

    Outdated content
    1. Pages I own that have not been reviewed or updated in a defined period of time
    2. A clear signal of how long it has been since the last update
    3. The ability to mark a page as reviewed without making edits, if the content is still current

    Unused images and media
    1. Images and files I uploaded that are not currently used on any page
    2. The file name, upload date, and file size so I can make an informed decision
    3. A way to archive or delete unused files directly from the dashboard

    Unpublished drafts
    1. Pages I have started but never published
    2. The last date I saved the draft, so I can identify ones that have been forgotten
    3. A direct link to open the draft and either publish it or discard it

    Expiring and review-due content
    1. Pages where a review date or expiry date is approaching in the next 30 days
    2. Pages where no review date has been set at all, flagged as a governance gap
    3. The ability to extend a review date or set one if it is missing

    Rule-Based Automation Layer (if possible)
    Defined rules such as:
    1. Draft older than 90 days → archive or notify owner
    2. Redirect chains > 2 hops → auto-flag for cleanup
    3. 404 URLs with traffic → auto-suggest redirect
    4. Orphan pages (no inbound links) → flag or archive

    What the editor does not need to see
    The dashboard should not show content owned by other editors (exception for admins, site managers & super users). It should not show global site statistics. It should not require the editor to filter, search, or configure anything to get to their personal view. When they log in, their issues are the first thing they see.

    Why this is a single solution, not multiple tools
    We considered building separate reports for each of these issues. We decided against it. Separate reports mean editors have to remember to check multiple places. Most will not. A single dashboard that loads at login means the information finds the editor, the editor does not have to go looking for it. This also means one build, one place to maintain, and one consistent experience for all 100+ editors regardless of which site or market they work in.

    Attached are vizualisation ideas- not anything we have as of today.

    As a content editor, I want to see a personalized dashboard when I log in to the CMS that shows me only the content I own that needs attention, so that I can find and fix issues myself, without waiting for someone else to tell me about them.

    This dashboard replaces the generic default view in the CMS for all content editors. It does not replace any existing admin tools or reports. The intent is to move content governance from a reactive, admin-led activity into a proactive, editor-led habit. The dashboard is the trigger for that behavioural shift. This is… more

    •  

    •  

    2 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    New  ·  0 comments  ·  Reports  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

15. Regenerate Content Graph keys and secrets through Paas portal

    Clients should have the ability to regenerate Content Graph keys and secrets in the self-service Paas portal.

    6 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  DXP, Hosting & Infrastructure  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating
    Research & Design  ·  AdminCiara Bergin (Principal Product Manager, Optimizely) responded

    Good news - this idea is now being explored by our product and design teams. We’re researching potential solutions and scoping out what an implementation might look like. We’ll share updates here as our thinking evolves.

16. DXP support for apex domain

    Currently DXP only supports complete hostnames containing both the subdomain and apex domain e.g. www.mywebsite.com.

    We would like to request support for configuring the apex (root) domain (e.g. mywebsite.com) as the primary domain within DXP.

    Traffic can then be redirected from www.mywebsite.com to mywebsite.com.

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    New  ·  0 comments  ·  DXP, Hosting & Infrastructure  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

17. Implement SRI attributes for injected JavaScript & Styles

    The Optimizely PAAS CMS platform has multiple touchpoints where scripts are injected into the frontend UI. Examples include Optimizely Forms, Content Recommendations, Search & Navigation etc.

    When these scripts are injected into the UI, they are not added with a Sub-resource Integrity attribute. An SRI check allows us to instruct the browser that it should not load a tampered version of a JS or CSS file and can protect users from man in the middle attacks. You can read more about SRI here: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

    This is a commonly reported issue in penetration tests and clients are becoming increasingly more security conscious and request that we make sure SRI attributes are in place. While we can add SRI checks for JS and CSS files that we generate, the files injected by Optimizely lack these attributes. We are left explaining to the customer that we do not control these scripts and styles

    Our desired output would be that scripts and styles rendered by Optimizely code include an SRI attribute.

    The Optimizely PAAS CMS platform has multiple touchpoints where scripts are injected into the frontend UI. Examples include Optimizely Forms, Content Recommendations, Search & Navigation etc.

    When these scripts are injected into the UI, they are not added with a Sub-resource Integrity attribute. An SRI check allows us to instruct the browser that it should not load a tampered version of a JS or CSS file and can protect users from man in the middle attacks. You can read more about SRI here: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

    This is a commonly reported issue in penetration tests and clients are becoming increasingly more security… more

    10 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Security & Compliance  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating
    Future Consideration  ·  AdminMatthew Slim (Product Manager, Optimizely) responded

    Thanks for raising this - just to let you know this is now in our backlog. While we can’t share an exact release date yet, this means it’s planned for consideration in the future. Thanks for helping us prioritize this work.

18. Site-specific Wastebaskets for multisite

    As of now all sites share the same Wastebasket in a multisite. We need site-specific wastbaskets so that only the editors with access to a site (and wastebasket) can go to the site-specific wastebasket and delete content. Closing in to almost 100 sites with extreme amounts of data, our wastebasket is not possible to navigate - even for admins.

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Gathering Feedback  ·  1 comment  ·  Implementation  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

19. IP Address restriction in Cloudflare

    It would be great if we could configure an IP Address whitelist in Cloudflare so that we only allow a specific set of source IP Addresses to be allowed to access our DXP instances. This will allow us to block public access to non-production environments

    2 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    New  ·  0 comments  ·  DXP, Hosting & Infrastructure  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

20. Access restricted for Specific user with expert import

    We need to configure roles in Optimizely to grant specific users permission to use the Import and Export functionality.

    Access must be restricted based on the users’ assigned business units. For example, if a user is assigned access only to Asteco, they should be able to perform import and export activities strictly within the business units (e.g., Asteco and Pactive) aligned with their permissions.

    Users must not have visibility of or access to any other projects beyond their assigned business units.

    3 votes

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    New  ·  0 comments  ·  Export / Import  ·  Delete…  ·  Admin →
    How important is this to you?

    Nice to have You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating