chatwoot User Identity Validation isn’t filtering out the unverified users/messages as expected

Describe the bug

I am using the Chatwoot widget on my website hosted in my server. Despite enabling Identity validation using HMAC as per the Chatwoot Guide, I am encountering an issue where messages from unverified users still appear in my inbox. Verified users are working as expected, but the validation does not seem to prevent unverified users' messages from being displayed.

To Reproduce

Copy the Chatwoot widget script:

Navigate to: Account Settings -> Inboxes -> [Inbox Name] -> Configuration -> Messenger Script Copy the provided widget script. Launch your website with the imported widget:

<!DOCTYPE html>
<html lang="en">

<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>My React App</title>
</head>

<body>
  <noscript>You need to enable JavaScript to run this app.</noscript>
  <div id="root"></div>
  <script>
    function getURLParameter(name) {
      return decodeURIComponent((new RegExp('[?|&]' + name + '=' + '([^&;]+?)(&|#|;|$)').exec(location.search) || [null, ''])[1].replace(/\+/g, '%20')) || null;
    }

    (function (d, t) {
      var BASE_URL = "https://dev.chat.pollin.dev";
      var g = d.createElement(t), s = d.getElementsByTagName(t)[0];
      g.src = BASE_URL + "/packs/js/sdk.js";
      g.defer = true;
      g.async = true;
      s.parentNode.insertBefore(g, s);
      g.onload = function () {
        window.chatwootSDK.run({
          websiteToken: 'xxxxxxxxxxxxxxxxx',
          baseUrl: BASE_URL,

        });
      };
    })(document, "script");

    window.addEventListener("chatwoot:ready", function () {
      
      var id = getURLParameter('id');
      var name = getURLParameter('name');
      var hash = getURLParameter('hash');

      window.$chatwoot.toggle();

      if (id && name) {
        window.$chatwoot.setUser(id, {
          email: id,
          name: name,
          identifier_hash: hash,
        });
      }
    });

  </script>
</body>

</html>

Expected behavior

Messages from unverified users should not appear in the inbox. Only messages from users who have been successfully verified through HMAC identity validation should be visible.

Environment

Other [please specify in the description]

Cloud Provider

None

Platform

Browser

Operating system

No response

Browser and version

No response

Docker (if applicable)

No response

Additional context

No response

May 17 '24 21:05 gabediazm

PR-1096 User Identity Validation isn’t filtering out the unverified users/messages as expected

May 17 '24 21:05 linear[bot]

@gabediazm I'm also facing this issue, but I'm getting a 401 error at console that I think is preventing the validation. Can you please check if you are getting any console error?

In my case, when I choose "Enforce User Identity Validation" I start to receive the error at console (below).

PATCH https://contoso.com/api/v1/widget/contact/set_user?website_token=xxx&cw_conversation=xxx 401 (Unauthorized)

May 18 '24 09:05 fabr2004

@fabr2004 Tested and not getting any error in console:

May 20 '24 13:05 gabediazm

@gabediazm I have solved my 401 error and now I can confirm the same behavior you described. I'm receiving messages from both verified and unverified sessions, even though I have "Enforce User Identity Validation = true" at this inbox configuration.

May 20 '24 13:05 fabr2004

@gabediazm Please add required details, like Chatwoot version you're running.

May 20 '24 13:05 fabr2004

@fabr2004 Im using v3.8.0 | Build 85aeaf2aee0a3d3acf7c806f12c2db81d6b5110f

May 20 '24 14:05 gabediazm

@fabr2004 Im using v3.8.0 | Build 85aeaf2aee0a3d3acf7c806f12c2db81d6b5110f

There is a newer version, 3.9.0, but this issue does also occur at this newer version (I'm currently using it, build f7580f864c837a0e5efa39fe3696e7a224327e11).

May 20 '24 15:05 fabr2004

The current behavior of enforced identity validation is over the setUser call alone. When mandatory HMAC is enabled, user attributes can’t be set from the frontend without the HMAC token.

The recommendation is not to include the Chatwoot widget JavaScript on non-authenticated pages if you want to avoid the chats. We will look into making this configurable.

May 23 '24 23:05 sojan-official

Closing this here as we will not be making any immediate change in the behavior, will re-open if we reprioritize.

Jul 08 '24 05:07 pranavrajs

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

Aug 07 '24 05:08 github-actions[bot]