microsoft / microsoft/BotFramework-WebChat
Investigate improving security by default
Open
Nobody has claimed this yet.
feature-request
- Dominant language
- HTML
- Stars
- 1.8k
- Forks
- 1.6k
- Avg merge
- 22h 58m
- Merged PRs (30d)
- 2
Description
Is your feature request related to a problem?
If customers doesn't need customization other than branding/styling, they should use Web Chat in IFRAME to reduce attack surface.
### Tasks
- [ ] Prefer ABS IFRAME if customization is not required (branding/styling is very limited, #4850 will solve it)
- [ ] CDN bundle: recommend Content Security Policy in `console.log`
- [ ] Will putting chat adapter in `SharedWorker` improve security?
Describe the suggestion or request in detail
No response
Describe alternatives you have considered
No response
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or concrete entry points. Begin by reviewing the Web Chat IFRAME, CDN bundle, Content Security Policy, and SharedWorker areas, then determine which security investigation should be scoped first. Done would require a decided approach and explicit acceptance criteria for the selected task.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100