Full Referrer URL from Website Page to Marketo LP Form Submit

[Darshil_Shah1]

Two different domains (e.g. example.com and subdomain.example.com) can only share cookies if the domain attribute is present in the header:

Set-Cookie: name=value; domain=example.com

Of course, the domain attribute must domain-match the request URL to be valid, which means it must be the request domain or a "parent" domain. This cookie would then be sent for example.com and any subdomain of example.com, including nested subdomains like subsub.subdomain.example.com.

With this background, and given that the parent domain is same in your case (idc.com) I think you could explore the option of setting the current URL in the cookie with domain=idc.com and then using it to autofill in the form's hidden field on the pages.idc.com page.

[SanfordWhiteman · Accepted solution]

---

I've included two links as an example and would like to confirm that if we were to go with Sanford's #2 suggestion with marking up the <a> tag with the correct referrer policy will it actually work with our domain setup.

---

The referrerpolicy attribute works with any domains, so yes!

We wanted to know the domains to see if cookies would also work, and yes, they would: your domains share the common private domain idc.com so they can share cookies.

I’d personally go with referrerpolicy though, because it’s easiest to roll out.

[Liz_Nguyen1]

Hi Sanford,

If going with the referrerpolicy option, do we also need to have a new field created to store this value so we could add the value into an alert email?

[Liz_Nguyen1]

Hi @SanfordWhiteman or @Darshil_Shah1 ,

We had a few additional questions that popped up when discussing the options you had suggested.

With regards to the referrerpolicy="unsafe-url" as you mentioned it is the easiest to rolle-out and can be used with any domain so our current setup means we can use this method. However, could you confirm if using "unsafe-url" would open us to any potential risks/threats, if so we would want to evaluate other options. If we did go with this method, the would we only need to update the <a> tag wherever we link from website to Marketo LP (on a link by link basis)? Also wondering how do we store the URL we receive from the referrerpolicy into a field where we could later use in an alert email. Could you break down the steps needed?

With the other method of using UTMs, this means we would need to create another utm field within our instance, correctly tag the link with UTM parameter and value, then have the form auto-fill that value from the UTM parameter?

As Darshil confirmed, we could share cookies between the two webpages as they share the same private domain. Would this require dev work from a developer? I am not an expert so trying to better understand our options. 

Thanks again, appreciate the insights on this!

[Darshil_Shah1]

AFAICT, when referrerpolicy="unsafe-url" is used, the full URL of the referring page will be included in the Referer header when navigating to the target page. This can potentially leak sensitive information, such as private user data or authentication tokens, to the target site or third-party servers if those are ever included as a part of the URL. I'll let Sandy pitch in and confirm as well. 

---

how do we store the URL we receive from the referrerpolicy into a field where we could later use in an alert email. Could you break down the steps needed?

---

I believe you can use form JS to write the referrer URL to a hidden field added in the Marketo form, and then use that field as a token in the email. If you just want to grab the parameters in the referral URL, you can use the OOTB autofill hidden field with the respective referrer parameter instead of using JS to grab the URL, and then get UTMs out of it (See this documentation).