User Identity Validation isn’t filtering out the unverified users/messages as expected about chatwoot HOT 8 OPEN

@gabediazm
I'm also facing this issue, but I'm getting a 401 error at console that I think is preventing the validation.
Can you please check if you are getting any console error?

In my case, when I choose "Enforce User Identity Validation" I start to receive the error at console (below).

PATCH https://contoso.com/api/v1/widget/contact/set_user?website_token=xxx&cw_conversation=xxx 401 (Unauthorized)

from chatwoot.

@fabr2004 Im using v3.8.0 | Build 85aeaf2aee0a3d3acf7c806f12c2db81d6b5110f

There is a newer version, 3.9.0, but this issue does also occur at this newer version (I'm currently using it, build f7580f864c837a0e5efa39fe3696e7a224327e11).

from chatwoot.

PR-1096 User Identity Validation isn’t filtering out the unverified users/messages as expected

from chatwoot.

@fabr2004 Tested and not getting any error in console:

from chatwoot.

@gabediazm
I have solved my 401 error and now I can confirm the same behavior you described.
I'm receiving messages from both verified and unverified sessions, even though I have "Enforce User Identity Validation = true" at this inbox configuration.

from chatwoot.

@gabediazm
Please add required details, like Chatwoot version you're running.

from chatwoot.

@fabr2004 Im using v3.8.0 | Build 85aeaf2aee0a3d3acf7c806f12c2db81d6b5110f

from chatwoot.

The current behavior of enforced identity validation is over the setUser call alone. When mandatory HMAC is enabled, user attributes can’t be set from the frontend without the HMAC token.

The recommendation is not to include the Chatwoot widget JavaScript on non-authenticated pages if you want to avoid the chats. We will look into making this configurable.

from chatwoot.