In Experience Manager we can "preview" SmartTarget promotions, typically on (CD) Staging, using the Footprint feature.

The documentation mentions the Ambient Data Framework configuration file (cd_ambient_conf.xml) where we need to allow the Claim URIs for Custom Footprints in GloballyAcceptedClaims.

If the Live server's cd_ambient_conf.xml allows Custom Footprints, could these be set in Experience Manager to test SmartTarget promotions? We can enter a URL directly into Experience Manager, without the page actually running in XPM.

Enter Web site address prompt

In other words, must a page be XPM-enabled to use Custom Footprints?

The use case is giving CMS users the ability to confirm a SmartTarget promotion in the Live website.

1 Answer 1


Technically, that part of the footprints feature doesn't need XPM to run. However, there are at least two reasons why you should only do it on a staging site with XPM:

  1. The cookie is set by XPM (and cookies are only valid for the current site). Without XPM, you would need to set these footprint cookies yourself.
  2. Allowing the overwriting of claims is actually a security risk. You are essentially allowing anyone to write data to memory on your website. Although that's also a risk on a staging site, it's not as likely that one of your employees will abuse it (and if they do, they're much easier to track down). Although any would-be attacker would need to know a lot about this feature and how to write the cookie, it still seems like a risk you don't want to take on your live production environment.

Ideally, users are able to trust that if the Promotion fires on the staging site, it also fires on the live site. But I can understand the urge to validate that.

You could consider creating a test page that allows you to tweak the claims. That way, it can tightly control what data gets set on what claims (i.e. don't allow any arbitrary input from the client) - thus minimizing the security risk while still allowing you to verify that the Promotions work on the live site.

However, even a testing page is no guarantee that real visitors see what you want. If the claims are not set anywhere else on the website, no visitor will see your Promotions anyhow. So your test page would actually lead you to believe everything is working, when it fact it is not.

In the end, it's possible that only careful examination of the log files will tell you if there is a problem with your triggers and thus your Promotions. I would say that is up to the developers/ops guys to ensure -- and your editors should just be able to trust that the live site has the same triggers as the staging does, and so what they see on staging will also apply on the live website.

  • Okay, I can follow the suggestion and suggest clients keep Staging and Live promotion content the same. I've also seen setups and 3rd party tools that can do things like test a site from various IP addresses, using different (emulated or actual) devices, etc. Jun 23, 2015 at 15:06
  • Oh not that I'd encourage it, but is the Security Element in the CD ADF config related to allowing such claims "tweaks?" Could there be a single isolated test machine "whitelisted" to test against Live like this or is this for something else? Jun 23, 2015 at 15:07
  • Yes, you could combine it with the whitelist which makes it less of a security risk. Jun 23, 2015 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.