Verify CSRF / embedding

[Antazia]

Hello, I just uploaded the docker on a VPS and changed every variable related to localhost to my server IP.

The embedding on another external website, then, is only working when I remove VerifyCSRFToken from the middlewaregroup.

I can't understand why, as send-message and /chat are excluded from the group (by default) and routes are also excluding it.

But with VerifyCSRFToken I get error 419 related to send-message:1.

Could you give me a fast explanation of the problem ? (It's happening even with default config, just changed the localhost address for chat.css/chat.js

Thanks!

[gharbat]

Thanks for reporting this, Indeed it's not and optimal situation, it happens because we use iFrame instead of JS/APIs, which effectively mean we are sessions based, and we do send POST requests.

For now, I think your fix of adding it to the exclude list will work.

This week we will replace the whole chat widget with a much better one, and this problem will be solved too :)

[Antazia]

Are you releasing it on the github repo or only in openchat.so?

Thanks :)

[gharbat]

Both :)

[gharbat]

Fixed in https://github.com/openchatai/OpenChat/releases/tag/0.31