Skip to content

Conversation

@deepak0x
Copy link
Contributor

@deepak0x deepak0x commented Jan 25, 2026

This PR fixes a critical authentication issue where multiple EmbeddedChat instances running on the same domain were overwriting each other’s login sessions.

The problem was caused by a hardcoded localStorage key (ec_token) used by all instances. As a result, logging into one EmbeddedChat instance would invalidate the session of another.

This fix introduces namespaced storage keys, ensuring that each EmbeddedChat instance maintains an isolated authentication session based on its configuration.


Closes #1105

Solution

  • Token storage is now scoped per instance using a dynamic storage key.

  • Each EmbeddedChat instance generates its own unique key using:

    ec_token_${host}_${roomId}
    
  • This guarantees session isolation across different servers or rooms.


Changes Made

1. auth.js

  • Refactored getTokenStorage to accept a dynamic storage key instead of using a hardcoded value.
  • The function now returns closures that are bound to the provided key, ensuring correct token access per instance.

2. EmbeddedChat.js

  • Generates a unique storage key using host and roomId.
  • Passes this key to the authentication module.
  • Wrapped getTokenStorage in useMemo to prevent unnecessary re-renders, since it returns new function references on each call.

Performance Consideration

  • useMemo is used to memoize the token storage handlers.
  • This avoids repeated re-creation of functions during re-renders and keeps component behavior stable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Cross-Instance Authentication Corruption via Hardcoded ec_token Key

1 participant