Hello ALL!
# 🌎generalt
thousands-garden-28320
07/09/2024, 11:21 AMHello ALL!
Hello @bumpy-butcher-41910
To embed a chatbot into a website, is there a way to limit the embedding to certain domains?
b
bumpy-butcher-41910
07/09/2024, 5:40 PMcurrently no, not directly from within Botpress
bumpy-butcher-41910
07/09/2024, 5:40 PMwhat you're trying to do?
t
thousands-garden-28320
07/10/2024, 5:01 AMLimit the domains which chatbot can function on
thousands-garden-28320
07/10/2024, 5:05 AMNow it can be embedded on any domain. Is there a way to define certain domains?
thousands-garden-28320
07/10/2024, 8:28 AM@bumpy-butcher-41910
My client is worried that people might hijack the embedded bot:
"Is there no way of limiting domain? It’s too easy for someone to embed it
on unauthorized site and run up my bills."
Can you help me to address his concern?
b
bumpy-butcher-41910
07/10/2024, 2:10 PMwe don't currently have an elegant solution for this - we're in the process of investigating methods to whitelist certain domains, to avoid this problem, but nothing at the moment
t
thousands-garden-28320
07/10/2024, 4:17 PMThank you!
I think that'd be an essential feature to have.
b
bright-librarian-49252
07/11/2024, 5:47 PMHi Robert - this answer is not going to work. Anyone who copy/pastes the embed code can run up our costs with zero protection on our side.
bright-librarian-49252
07/11/2024, 5:47 PMThis is software switching worthy.
bright-librarian-49252
07/11/2024, 5:47 PMI can't use this software.
bright-librarian-49252
07/11/2024, 5:48 PMI cannot be the only person who is scared that an embed code copy/pasted can run billing through the roof. This is a major security liability.
t
thousands-garden-28320
07/11/2024, 5:48 PM@bumpy-butcher-41910
b
bright-librarian-49252
07/11/2024, 5:51 PMUsing the referrer to control access to the embed code is indeed a simpler approach. Here’s how you can implement this solution:
Step 1: Domain Registration
Register the domains that are allowed to use the embed code.
Step 2: Embed Code with Referrer Check
Check the HTTP referrer to ensure the request is coming from an allowed domain.
Step 3: Serve the Embed Code
b
bumpy-butcher-41910
07/11/2024, 7:25 PMhi all - a quick update: domain whitelisting is a service that's currently in an access period for Team plan subscribers
bumpy-butcher-41910
07/11/2024, 7:25 PMif you have further questions about this, you can reach out to our sales team, who can guide you through a Team plan subscription 🙂
2 Views