Share feedback, ideas and get community help

Updated 7 months ago

Bugs (avatar upload and CORS)

There are two bugs:
  • The allowed origin is not working. I can still embed the chatbot on other domains and chat with it.
  • The image upload is not working. I can not upload Bot Avatar via file upload. I have to server my image via jsdelivr and insert the link.
B
T
20 comments
Image upload is working fine on my end! Can you record a video?
Can you provide an example of a site that has a bot which should not be able to start?
it shouldn't appear on w3school because i specified https://skillup.day as allowed domain
image upload is working now.
That's because you are embedding using an iframe here
So the request origin is typebot.co which is allowed
I wonder if I can prevent iframe embedding as well 🤔
Indeed, if embedded iframe’s origin is the same as the API’s origin, requests won't be blocked due to CORS
So the allowed origins mechanism work only if you try to embed the bot with the embed library (not iframe)
I can add a mechanism to disallow this 🙂
Thanks for reporting this!
Content Security Policy: frame-ancestors example.com;

This cloud solve it.
It will be hard to enforce all this from the server. The best I can do for now is to do client-side check on origins
Will deploy that next monday 👍
Add a reply
Sign up and join the conversation on Discord