search

baptisteArno / typebot.io

💬 Typebot is a powerful chatbot builder that you can self-host.
https://typebot.io
Other
7.26k stars 1.99k forks source link

Prevent bots from accessing via direct URLs. #1812

Open vsnshanmuganathan opened 1 week ago

vsnshanmuganathan commented 1 week ago

Is your feature request related to a problem? Please describe. Screenshot 2024-09-29 at 10 22 21 PM When we configure Allowed Origins with our specified domains, it restricts access for other domains. However, if the bot can be accessed directly via URL, it remains open to everyone. This means that while the restriction effectively prevents external sites from embedding the bot, it does not stop unauthorized access through direct links.

Describe the solution you'd like I recommend adding an option or toggle in either the Security Settings or Share tab that allows us to control whether the bot can be accessed directly via URL. This feature would help prevent unauthorized access to the bots.

Describe alternatives you've considered At present, I don't see any alternative solutions to address this issue. Even when embedding bots in an iframe, users can right-click and inspect the element, revealing the bot's URL, which can then be easily copied and accessed by anyone.

anandaashish74711 commented 1 week ago

Hi @vsnshanmuganathan and @baptisteArno, I'd like to work on this issue and propose a solution. Could you please assign this task to me?