1

When remote profiles are enabled for a CiviCRM site, it says the following:

Warning: External profile support (aka "HTML Snippet" support) is enabled in system settings. This setting may be prone to abuse. If you must retain it, consider HTTP throttling or other protections.

A page on civicrm.org says the following about "HTML Snippets" (remote profiles):

if your system has used the "HTML Snippet" technique, then you should evaluate measures such as:

  • Configure HTTP firewalling to prevent POSTs to CiviCRM from unrecognized referrers
  • Replace the "HTML Snippet" with a custom integration that uses a more secure data-flow based on APIv3 and REST.

Using the API for some of our related sites isn't a great option considering how easy it is to add a form to other domains.

What is HTTP firewalling? Does that require scanning referrers of POST requests, and ensuring that the originate from the CiviCRM instance or trusted sites? Is it possible to do this with a CiviCRM extension? Does such an extension already exist?

Thanks for your help. : )

Improve this question

1 Answer 1

Reset to default
1

There are a couple of other methods that would be worth checking

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.