Skip to content

Commit f208e63

Browse files
authored
Security: Remove mentions of deprecated and unsafe Accept JWT signed identities mode for Engage Messaging Web. RD-28451 (#168)
1 parent 34b3cb6 commit f208e63

File tree

2 files changed

+1
-4
lines changed

2 files changed

+1
-4
lines changed

docs/interactions/web-messaging/community.md

-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ RingCentral Engage Messaging supports registering information about the visitor
3333

3434
The `Signed identities` field configures the handling of those signed identities by the Server:
3535

36-
* **Accept JWT signed identities** : either non-signed and signed information are accepted. This is a flexible mode. It is **not recommended for production**, see details [here](../integration#security).
3736
* **Reject JWT signed identities** : only non-signed information is accepted. This is a strict mode.
3837
* **Require JWT signed identities** : only signed information is accepted. This is a strict secure mode. This is the default value.
3938

docs/interactions/web-messaging/integration.md

+1-3
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ The server in RingCentral Engage currently uses the following JWT extensions:
9595

9696
!!! warning "Required data"
9797
The **“uuid”** key with a valid value is **mandatory** in the JWT payload.
98-
When missing, the JWT will be rejected, a default identity will be used, and, if the **“Require JWT signed identities” JWT mode** is set on the community profile, the chat won't open.
98+
When missing, the JWT will be rejected and the chat won't open.
9999

100100
#### Generation of the JWT
101101

@@ -145,8 +145,6 @@ This code has to be inserted in the HTML source of the target website. It can be
145145

146146
#### Security
147147

148-
The **“Accept JWT signed identities” JWT mode** is an unsecure mode for production if you are using JWT to set your user's data since it also allows non-signed identities. This mode is **not recommended** when you have a JWT integration.
149-
150148
To be able to share the history cross device between web and mobile, the mobile SDK uses a JWT to authenticate the user through its UUID. But then if you allow non-signed identities on the web, there is a security risk since, without a JWT, identity UUID is not guaranteed to come from your system.
151149

152150
## Custom Variables Integration (optional)

0 commit comments

Comments
 (0)