Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

User Identity Validation isn’t filtering out the unverified users/messages as expected #9493

Open
gabediazm opened this issue May 17, 2024 · 8 comments
Open

User Identity Validation isn’t filtering out the unverified users/messages as expected #9493

gabediazm opened this issue May 17, 2024 · 8 comments

Comments

@gabediazm
Copy link

gabediazm commented May 17, 2024 •
edited

Describe the bug

I am using the Chatwoot widget on my website hosted in my server. Despite enabling Identity validation using HMAC as per the Chatwoot Guide, I am encountering an issue where messages from unverified users still appear in my inbox. Verified users are working as expected, but the validation does not seem to prevent unverified users' messages from being displayed.

image

To Reproduce

Copy the Chatwoot widget script:

Navigate to: Account Settings -> Inboxes -> [Inbox Name] -> Configuration -> Messenger Script
Copy the provided widget script.
Launch your website with the imported widget:

<!DOCTYPE html>
<html lang="en">

<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>My React App</title>
</head>

<body>
  <noscript>You need to enable JavaScript to run this app.</noscript>
  <div id="root"></div>
  <script>
    function getURLParameter(name) {
      return decodeURIComponent((new RegExp('[?|&]' + name + '=' + '([^&;]+?)(&|#|;|$)').exec(location.search) || [null, ''])[1].replace(/\+/g, '%20')) || null;
    }

    (function (d, t) {
      var BASE_URL = "https://dev.chat.pollin.dev";
      var g = d.createElement(t), s = d.getElementsByTagName(t)[0];
      g.src = BASE_URL + "/packs/js/sdk.js";
      g.defer = true;
      g.async = true;
      s.parentNode.insertBefore(g, s);
      g.onload = function () {
        window.chatwootSDK.run({
          websiteToken: 'xxxxxxxxxxxxxxxxx',
          baseUrl: BASE_URL,

        });
      };
    })(document, "script");

    window.addEventListener("chatwoot:ready", function () {
      
      var id = getURLParameter('id');
      var name = getURLParameter('name');
      var hash = getURLParameter('hash');

      window.$chatwoot.toggle();

      if (id && name) {
        window.$chatwoot.setUser(id, {
          email: id,
          name: name,
          identifier_hash: hash,
        });
      }
    });

  </script>
</body>

</html>

Expected behavior

Messages from unverified users should not appear in the inbox. Only messages from users who have been successfully verified through HMAC identity validation should be visible.

Environment

Other [please specify in the description]

Cloud Provider

None

Platform

Browser

Operating system

No response

Browser and version

No response

Docker (if applicable)

No response

Additional context

No response
@gabediazm gabediazm added the Bug label May 17, 2024
@linear Linear
Copy link

linear bot commented May 17, 2024

PR-1096 User Identity Validation isn’t filtering out the unverified users/messages as expected

@fabr2004
Copy link

@gabediazm
I'm also facing this issue, but I'm getting a 401 error at console that I think is preventing the validation.
Can you please check if you are getting any console error?

In my case, when I choose "Enforce User Identity Validation" I start to receive the error at console (below).

PATCH https://contoso.com/api/v1/widget/contact/set_user?website_token=xxx&cw_conversation=xxx 401 (Unauthorized)

@gabediazm
Copy link
Author

gabediazm commented May 20, 2024 •
edited

@fabr2004 Tested and not getting any error in console:

image

@fabr2004
Copy link

@gabediazm
I have solved my 401 error and now I can confirm the same behavior you described.
I'm receiving messages from both verified and unverified sessions, even though I have "Enforce User Identity Validation = true" at this inbox configuration.

@fabr2004
Copy link

@gabediazm
Please add required details, like Chatwoot version you're running.

@gabediazm
Copy link
Author

@fabr2004 Im using v3.8.0 | Build 85aeaf2aee0a3d3acf7c806f12c2db81d6b5110f

@fabr2004
Copy link

@fabr2004 Im using v3.8.0 | Build 85aeaf2aee0a3d3acf7c806f12c2db81d6b5110f

There is a newer version, 3.9.0, but this issue does also occur at this newer version (I'm currently using it, build f7580f864c837a0e5efa39fe3696e7a224327e11).

@sojan-official
Copy link
Member

The current behavior of enforced identity validation is over the setUser call alone. When mandatory HMAC is enabled, user attributes can’t be set from the frontend without the HMAC token.

The recommendation is not to include the Chatwoot widget JavaScript on non-authenticated pages if you want to avoid the chats. We will look into making this configurable.

@pranavrajs pranavrajs removed the Bug label May 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@sojan-official @pranavrajs @fabr2004 @gabediazm