-
Story
-
Resolution: Done
-
Normal
-
None
-
None
Create a server-side API endpoint that can generate a sha256 hash of the logged-in user's web user ID based on a secret key provided by Intercom, then add user_hash to Segment's identify() call in console.
For a simple example, see Intercom security settings here (select Segment installation method).
Note: We may end up using separate Intercom instances per-module in the console, where each Intercom instance would use a unique secret key.
Background: Intercom adds live chat functionality within console.redhat.com. Users are identified by their web user ID. All the code runs client-side in JavaScript. Currently, it would be possible for a user to impersonate any other user simply by knowing the user's web user ID and editing some client-side code in browser. To prevent that, Intercom offers what they refer to as "Identity Verification." With ID verification, Intercom provides a secret key you can use to send a hash of the user's ID in addition to the plain-text version of the user ID. The secret key and hash need to be stored/generated server-side otherwise impersonation would still be possible.