---
schema_version: "1"
id: 1a4c30539d0f869c6c974beeabb93a4f52283abf58da8bd3cbc38c8c6f6b73f0
title: Embedded Objects Not Allowed in HTML Attributes
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/commerce/264-0-0/rn_html_objects_b2c_21_3_w8774939_la.md
canonical_url: https://help.salesforce.com/s/articleView?id=commerce.rn_html_objects_b2c_21_3_w8774939_la.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 168d6790622489b6caebe487a4c8dea78d234e9bde2884e812603a87f7c9b4e0
description: For security reasons, only Business Manager users with strong authentication, such as through multi-factor authentication with Account Manager, can include objects embedded with iframe, object, applet, or embed tags in the HTML attributes of a database object. A Business Manager user with strong authentication can temporarily allow users without strong authentication to embed objects in HTML attributes.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Embedded Objects Not Allowed in HTML Attributes

For security reasons, only Business Manager users with strong authentication, such as through multi-factor authentication with Account Manager, can include objects embedded with `iframe`, `object`, `applet`, or `embed` tags in the HTML attributes of a database object. A Business Manager user with strong authentication can temporarily allow users without strong authentication to embed objects in HTML attributes.

How: To temporarily allow users to embed objects, go to **Administration** | **Global Preferences** | **JavaScript in Attributes**, and click **Enable**. Users without strong authentication can embed objects in HTML attributes for 1 hour.

#### See Also

- [JavaScript and Objects in HTML Attributes](https://documentation.b2c.commercecloud.salesforce.com/DOC3/topic/com.demandware.dochelp/content/b2c_commerce/topics/admin/b2c_javascript_in_html_attributes.html)