RocketChat / RocketChat/EmbeddedChat
Bug: Image attachment previews return 403 Forbidden (uploaded images not visible in chat)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 165
- Forks
- 381
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 1
Description
Description:
After a file is successfully uploaded via EmbeddedChat, the image attachment preview in the chat message fails to load with a 403 Forbidden error. The file uploads correctly to the server, but the tag rendering the preview has no authentication headers, so RC's default "Block Unauthenticated Access" setting blocks the request.
Steps to reproduce:
- Log in and navigate to a channel
- Click the attachment button and upload any image file
- Observe the chat message after the upload completes
Expected behavior:
The uploaded image should render as a preview inline in the chat message.
Actual behavior:
The image preview area is blank/broken. The browser console shows:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the attachment upload result into the chat message's image preview and inspect how the rendered request is authenticated. Reproduce with Rocket.Chat's "Block Unauthenticated Access" setting enabled; done means uploaded images render inline without a 403 response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, react
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100