Signed-in visitors

When your site has accounts, the chat can know who asked: the Stats and the History then show the visitor’s email instead of Anonymous. Your pages can be made in any language; only the chat itself runs on PHP.

On the pages of a visitor who is signed in to your site, the script tag of the chat carries two more attributes:

<script src="/opensolr-chat/widget.js" data-ident="EMAIL" data-ident-sig="SIGNATURE" defer></script>

• EMAIL is the visitor’s email, escaped for an HTML attribute.
• SIGNATURE is made by your server from that email and the chat’s identity key (below).
• A visitor who is not signed in gets the plain tag, without the two attributes.

The signature is HMAC-SHA256 of the email in lower case, with the identity key of your chat as the key, written in lower-case hex: 64 characters.

1. Open the admin of your chat, tab Add to your pages, and copy the identity key.
2. Keep it in your site’s server configuration, like any other secret, never in a page or in JavaScript.
3. On each page of a signed-in visitor, make the signature with one of the examples below and write the two attributes.
4. Check your code: the same tab shows the signature your chat expects for visitor@example.com. Your code must give exactly that.

The identity key changes only if the chat’s signing secret is replaced; then copy the new one.

The package writes both attributes for you, signed and escaped, and nothing when $email is empty (a visitor who is not signed in). The first argument is the data_dir of your front controller; the tab Add to your pages shows this line with your own folder:

<script src="/opensolr-chat/widget.js"<?= \Opensolr\ChatBot\Identity::attributes('/opt/opensolr-chat', $email) ?> defer></script>

A PHP application that does not load the package signs it with one line:

$signature = hash_hmac('sha256', strtolower(trim($email)), IDENTITY_KEY);

import hmac, hashlib

signature = hmac.new(IDENTITY_KEY.encode(), email.strip().lower().encode(), hashlib.sha256).hexdigest()

In a Django or Flask template, write data-ident and data-ident-sig with the template’s own escaping, only when the visitor is signed in.

Use its HMAC with SHA-256: the key is the identity key as text, the message is the email trimmed and in lower case, the result is written in lower-case hex. Then compare with the signature of visitor@example.com shown in the admin.

• A visitor counts as signed in only when the signature is right for that email. No signature, or a wrong one, is an anonymous visitor: nobody can make the chat believe they are somebody else.
• The email is kept in lower case, so Ana@Example.com and ana@example.com are the same visitor.
• A conversation that starts anonymous and goes on after the visitor signs in takes the email.

The hosted chat signs visitors the same way, with the identity key of its Signed-in visitors tab: Signed-in visitors. The one-line PHP, Python and Node.js examples on this page work for both.