---
schema_version: "1"
id: 6c079b1fdec8a50fe3b4b0e58ad53857f22838cb5d7fb6b0b0e28cdda03ff67e
title: JavaScript and Objects in HTML Attributes for B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_javascript_in_html_attributes.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_javascript_in_html_attributes.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 321dbae0d849ff057c3f1d21ce735b5481f0d5e716e149fe6af46664d7372fc1
description: For security reasons, only Business Manager users with strong authentication, such as through multi-factor authentication with Account Manager, can include JavaScript and objects embedded with iframe, object, applet, or embed tags in the HTML attributes of a database object.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# JavaScript and Objects in HTML Attributes for B2C Commerce

For security reasons, only Business Manager users with strong authentication, such as through multi-factor authentication with Account Manager, can include JavaScript and objects embedded with `iframe`, `object`, `applet`, or `embed` tags in the HTML attributes of a database object.

A Business Manager user with strong authentication can temporarily allow users without strong authentication to include JavaScript and embed objects in HTML attributes. Click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then go to **Administration** | **Global Preferences** | **JavaScript in Attributes**, and click **Enable**. For 1 hour, users without strong authentication can include JavaScript and embed objects in HTML attributes.

To authenticate users using multi-factor authentication with Account Manager, enable Unified Authentication with Account Manager in Business Manager at **Administration** | **Global Preferences** | **Security**. Also, in Account Manager, assign the user’s account to a role that requires multi-factor authentication.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png)

Important Separate from the issue of JavaScript and embedded objects in HTML attributes, Salesforce strongly recommends that you implement multi-factor authentication for all Business Manager users.