Uploaded image for project: 'Hybrid Cloud Console'
  1. Hybrid Cloud Console
  2. RHCLOUD-24440

Intercom identity verification user ID hashing

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False
    • Unset
    • No
    • Plat-Ex Sprint 61

      Create a server-side API endpoint that can generate a sha256 hash of the logged-in user's web user ID based on a secret key provided by Intercom, then add user_hash to Segment's identify() call in console.

      For a simple example, see Intercom security settings here (select Segment installation method).

      Note: We may end up using separate Intercom instances per-module in the console, where each Intercom instance would use a unique secret key.

      Background: Intercom adds live chat functionality within console.redhat.com. Users are identified by their web user ID. All the code runs client-side in JavaScript. Currently, it would be possible for a user to impersonate any other user simply by knowing the user's web user ID and editing some client-side code in browser. To prevent that, Intercom offers what they refer to as "Identity Verification." With ID verification, Intercom provides a secret key you can use to send a hash of the user's ID in addition to the plain-text version of the user ID. The secret key and hash need to be stored/generated server-side otherwise impersonation would still be possible.

              mmarosi123 Martin Marosi
              jlucky@redhat.com Jacob Lucky
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: