Progressive Profiling/Form Prefill on Embedded form

[Anonymous]

Hello all,

I understand that, form prefill doesn't work when embedding a form on webpage.

Isn't there any way? really?

TIA.

Syed

H

[Anonymous]

Curious what you mean by this?

Edit: oh, you mean someone could exhaust our API limit. I'm managing that in a couple ways:

• Our daily API limit is much larger than the default 10k,
• I'm making the lead API call server-side thru our own REST endpoint, which is also rate-limited

[SanfordWhiteman]

True, if you throttle it through another service, you can at least mediate the DoS vulnerability against other integrations.  Whether you leave your forms service with enough calls per day to handle a successful campaign, especially if there are people with an unhealthy interest in your site, I can't say. 

The vast majority of Marketo customers do not pay for more API calls (nor do they understand that there is a shared limit across all integrations).  In most cases, using the API for this is bringing a huge risk and shouldn't be done.

More important, it isn't necessary.  This can be done without the API via a method I've been rolling out with clients for the past year. I guess I've sat on my solution long enough and I'm going to blog about it soon -- each time I see somebody suggest the API is another time I wish I had publicized it sooner!

[Anonymous]

Link the blog once you write it! Only other way I've seen is saving to cookies which is no good.

[SanfordWhiteman]

I will definitely link to it.

[Anonymous]

I'd also be very interested to read this blog if/when you write it!

[Robb_Barrett]

If you can iFrame in a marketo page, problem solved. I know iFrames aren't a perfect answer but they do work.

[Grégoire_Miche2]

HI Syed,

Progressive profiling does work on embedded forms.

-Greg

[Anonymous]

Could you elaborate? I think the progressive profiling works, but the pre-fill and "Known/Not Known" visitor functionality does not. Is there any documentation on how we could use these settings on external pages? We're trying to work through it with our web developer.

Thanks,

Justin

[SanfordWhiteman]

Known Lead HTML and ProgPro both work on embedded forms.  There's no special documentation necessary because they work automatically.

[Anonymous]

Hi Sanford Whiteman,

So just to recap all this thread, progressive profiling does work for embedded forms for all form fields (standard and custom) by using this processes http://developers.marketo.com/blog/external-page-prefill/ ?

Thanks.

[SanfordWhiteman]

No, it does not.

The process described should never be used by a professional organization. It leaves your instance open to a trivial Denial of Service attack and while it may work in the "lab" is not fit for the real world.

[Dan_Stevens_]

It should also be noted that "progressive profiling" works for embedded forms out-of-the-box.  PP is different than "form prefill"

[SanfordWhiteman]

Thanks, Dan. Yes, you don't even need any effort at all for Progressive Profiling to work. It already does.

[Anonymous]

Unfortunately this doesn't seem to be the case for us. We're embedding them in Wordpress pages and while the forms are showing the correct number of fields we ask progressive profiling to show, the pre-fill and "known/not known" visitor functionality is not working. I contacted Marketo support about this and they mentioned it's only guaranteed to work on Marketo landing pages and may work on external pages.

[SanfordWhiteman]

I never said Prefill worked, though.  That's a critical difference.  A lot of people confuse ProgPro and Prefill because they assume they are interdependent, when in fact ProgPro only requires that the client (browser) know whether a field has a value or not.  Because that doesn't constitute a security risk/PII leakage, it does work with embedded forms.

Similarly, Known Lead HTML only leaks first + last name and is allowed to work with embeds.

Can you send me a link to a URL where you have ProgPro and Known Lead HTML both enabled?  Never trust "may."

[Anonymous]

The progressive profiling was working, and now it's just showing every field every time. An example is here: https://www1.taskstream.com/resource/getting-the-most-from-edtpa-for-program-improvement/.

If you click on the thumbnail, the form will pop up.

[Anonymous]

Delivering Exceptional Skype for Business Quality of Experience | Exinda  -> Click this link, Marketo Form#1 will appear with 4 input fields. If you submit this page and come back again, MKTO + Cookies will have your info and Form#2 will load. You submit that and come back again, No Form (Form#3) will load and I've captured all the required info from you   I've used API calls to populate your missing info.

Its working for us! Thanks all sharing ideas

-Syed

[SanfordWhiteman]

... except you've introduced a DoS vulnerability by consuming an API call in response to individual end-user actions.

You've also created a wildcard CORS endpoint through which any third-party site can gather data on your leads just by knowing an email address.

I have major misgivings about this approach.

[Anonymous]

Yes, agreed with DoS attack. But for now, we are not even close to our 10k daily limit.

Not sure about CORS, can you explain?

Also, waiting for your blog

[SanfordWhiteman]

Yes, agreed with DoS attack. But for now, we are not even close to our 10k daily limit.

But it'll take an elementary hacker a half-hour to break everything.  That's too risky for my environments.

Not sure about CORS, can you explain?

You've created an endpoint that would allow me to retrieve data from your Marketo instance from any other site on the web. I'd only need to have the email address of a lead.  Such a vulnerability exists whenever you use prefill, but it is not typically possible from the browser on other sites. The fact that I can access your data from any other domain means you can't block malicious use by IP, since it could come from anywhere: a hacker could induce unwitting leads to, in effect, hack themselves.

[SanfordWhiteman]

I've just discovered a regression in Forms2 that breaks this functionality.  You (and I) are correct that it was working and stopped.

Justin Cooperman​ please contact me directly for into.