mirror of
https://github.com/chatwoot/chatwoot.git
synced 2026-06-13 21:01:16 +08:00
a4c3d3d8c0
When `allowed_domains` is configured on a web widget inbox, the server responds with Content-Security-Policy: frame-ancestors <domains>, which blocks the widget iframe in mobile app WebViews. This happens because WebViews load content from file:// or null origins, which cannot match any domain in the frame-ancestors directive. This adds a per-inbox toggle — "Enable widget in mobile apps" — that skips the frame-ancestors header when the request has no valid Origin (i.e., it comes from a mobile WebView). Web browsers with a real origin still get domain restrictions enforced as usual. <img width="2330" height="1490" alt="CleanShot 2026-03-11 at 10 13 01@2x" src="https://github.com/user-attachments/assets/d9326fac-020d-4ce7-9ced-0c185468c8fc" /> Fixes https://linear.app/chatwoot/issue/CW-6560/widget-is-not-loading-from-iosandroid-widgets How to test 1. Go to Settings → Inboxes → (Web Widget) → Configuration 2. Set allowed_domains to a specific domain (e.g., *.example.com) 3. Try loading the widget in a mobile app WebView — it should be blocked 4. Enable "Enable widget in mobile apps" checkbox 5. Reload the widget in the WebView — it should now load successfully 6. Verify the widget on a website not in the allowed domains list is still blocked --------- Co-authored-by: iamsivin <iamsivin@gmail.com> |
||
|---|---|---|
| .. | ||
| api | ||
| concerns | ||
| devise_overrides | ||
| installation | ||
| linear | ||
| microsoft | ||
| notion | ||
| platform/api/v1 | ||
| public/api/v1 | ||
| shopify | ||
| super_admin | ||
| survey | ||
| tiktok | ||
| twilio | ||
| webhooks | ||
| android_app_controller.rb | ||
| api_controller.rb | ||
| apple_app_controller.rb | ||
| application_controller.rb | ||
| dashboard_controller.rb | ||
| health_controller.rb | ||
| microsoft_controller.rb | ||
| oauth_callback_controller.rb | ||
| platform_controller.rb | ||
| public_controller.rb | ||
| slack_uploads_controller.rb | ||
| swagger_controller.rb | ||
| widget_tests_controller.rb | ||
| widgets_controller.rb | ||