A Cookie-Free Embeddable Support Widget: What Adversarial Review Caught

Short summary

Built an embeddable support widget without cookies—using short-lived bearer tokens signed with HMAC instead. An adversarial security review before launch caught four real vulnerabilities: a canonicalization bug in signed identity fields, missing origin validation, unclamped severity claims, and XSS in rendered HTML. The post details fixes: webhook deduplication, SSRF guards, and safe HTML parsing via inert DOM.

• •Embeddable widgets can't use cookies; token-based sessions with HMAC-signed assertions replace cookie-based auth
• •Security review caught 4 vulnerabilities before launch, including delimiter injection in signed tuples
• •Key patterns: webhook idempotency with dedupe keys, SSRF egress guards, and inert DOM parsing for XSS safety

Generated with AI, which can make mistakes.