Adversarial Review Exposes Four Security Flaws in Cookie-Free Support Widget

A developer building an embeddable helpdesk support widget opted for a cookie-free design, using short-lived bearer tokens in headers to avoid third-party cookie restrictions imposed by modern browsers. Entry into the widget relies on an HMAC-signed assertion from the host page, with session tokens hashed at rest so a cache leak yields nothing replayable. Before launch, an adversarial security review uncovered four vulnerabilities, including assertion replay attacks, a failed origin check, unrestricted severity levels, and a delimiter-based canonicalization flaw that allowed different identity tuples to share one valid signature. Outbound webhooks were hardened by signing exact stored bytes, adding a unique dedupe key to prevent double delivery, and blocking private or metadata IPs to guard against SSRF attacks. An HTML rendering issue in agent replies was also resolved by parsing content through an inert DOMParser document rather than using innerHTML, eliminating XSS risk on third-party pages.