-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update chat init args schema and improve security of auth docs (#138)
- Loading branch information
Showing
3 changed files
with
115 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -24,7 +24,9 @@ These details will be shown to you in the Plain app when you are chatting with t | |
If you want to match the customer to an existing customer in your workspace, you will need to pass their email. To avoid security issues around impersonation you will also need to | ||
provide the email address hashed using a shared secret. You can generate this secret in the Chat settings page in the Plain app. | ||
|
||
Once you have this secret, you can calculate the hash and pass it to the `Plain.init` function: | ||
Once you have this secret, you can calculate the hash. This must be done in backend code to avoid leaking the secret. If your secret is leaked malicious users will be able to impersonate your customers in chats. | ||
|
||
Backend code: | ||
|
||
```typescript | ||
import * as crypto from 'node:crypto'; | ||
|
@@ -34,6 +36,13 @@ const email = '[email protected]'; | |
const hmac = crypto.createHmac('sha256', secret); | ||
hmac.update(email); | ||
const hash = hmac.digest('hex'); | ||
``` | ||
|
||
Then you can request the hash from your backend and init Plain: | ||
|
||
```typescript | ||
const email = '[email protected]'; | ||
const hash = fetchHashFromBackend(email); | ||
|
||
Plain.init({ | ||
customerDetails: { | ||
|