when using iframe loader, setting parentOrigin is not work

[Snailmar]

iframe loader, I used chatbotUiconfig and set shouldLoadConfigFromJsonFile false, there are some questions
1.still load config.json

2.parentOrigin is not work, and there is an error chatbot UI failed to load

[atjohns]

Hi apologies for the delayed response, I'm looking into this and the root cause.

[touch-dev-null]

Any updates with this? It looks like it does not matter what you are going to set exactly for origin on you client:

` <script>

  // The loader constructor supports various configurable options used to
  // control how the component configuration and dependencies are retrieved.
  var loaderOpts = {
    // Point the baseUrl option to the the base URL used to download
    // the chatbot UI files and dependencies.
    // In this example, the base URL is relative to the root path
    // You can also use full URLs:
    //    baseUrl: 'https://iframe-host.example.org/lex-web-ui/'
    baseUrl: '/',

    // enable receiving chatbot UI config from event
    // the event is used as an alternative to passing the chatbot
    // UI via JSON file or via the parameter in the load() function
    shouldLoadConfigFromEvent: true,

    // Controls if it should load minimized production dependecies
    // defaults to true for production builds and false in development
    shouldLoadMinDeps: true,
  }

  // ChatBotUiLoader contains the IframeLoader constructor
  // Instantiate the loader and pass the loader options
  var iframeLoader = new ChatBotUiLoader.IframeLoader(loaderOpts);

  // You can override the chatbot UI config by passing a parameter
  var chatbotUiconfig = {
  // if the iframe page is hosted on a different site,
  // you should configure the parentOrigin and iframeOrigin
    ui: {
      // origin of the parent site where you are including the chatbot UI
      parentOrigin: 'http://localhost2',
      toolbarTitle: 'lalal'
    },`

For example above - parentOrigin will not work unless you change it in S3 bucket. Meanwhile toolbarTitle will overwrite value located in S3 Bucket

[atjohns]

Hey, I will look at this today. My assumption is that something is wrong with the configuration merge that happens on load but will need to test out everything. This is not a part of the code I've had much exposure to

[atjohns]

For this specific use case, we are intentionally blocking accepting dynamic parent origins because of the potential security risks. You can see the code that handles this here:

See the code starting on line 310 here: https://github.com/aws-samples/aws-lex-web-ui/blob/master/lex-web-ui/src/store/mutations.js