How can we limit DOM and browser storage access for AEP Launch scripts?
We are exploring ways to apply a least-privilege approach to third-party scripts loaded on an AEM website (on-prem hosted 6.6) through AEP Launch, including Adobe Analytics, Adobe Target, and extensions such as OneTrust.
Our concern is that JavaScript running in the page context may have broad access to the DOM and browser storage. As AI-assisted development becomes more prevalent, we want to ensure these scripts can access and track only the data explicitly intended for them.
We would like to understand:
-
Are there ways to limit which DOM elements or data AEP Launch rules and extensions can access?
-
Can access to
localStorage,sessionStorage, or cookies be restricted? -
Are there recommended patterns for isolating third-party libraries loaded through Launch?
-
Can CSP, sandboxed iframes, or other browser mechanisms help enforce these boundaries?
We understand browser-level isolation may be limited when scripts run in the same page context, but would appreciate any Adobe-recommended best practices or architectural patterns for reducing their scope and access.