The latest articles on DEV Community by Louis Madrigal (@louis2688). https://dev.to/louis2688 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F176417%2F149192e5-b8da-4e3d-a8be-d482513aa8c7.jpg https://dev.to/louis2688 en Louis Madrigal Sun, 02 Aug 2026 16:58:24 +0000 https://dev.to/louis2688/n8ns-chat-widget-puts-your-webhook-url-in-the-page-source-i-built-a-gateway-to-hide-it-2ij4 https://dev.to/louis2688/n8ns-chat-widget-puts-your-webhook-url-in-the-page-source-i-built-a-gateway-to-hide-it-2ij4 <p>If you've wired up n8n's Chat Trigger and pointed its widget at a public page, open dev tools and check the network tab. Your production webhook URL is sitting right there in the client-side JavaScript. Anyone can copy it and start posting to your workflow directly, from outside your site, with no rate limit and no auth in front of it.</p> <p>That's not a bug in n8n — the Chat Trigger is built to be called however you wire it up, including straight from a browser. It just means a public chatbot on a public page needs something in front of it before it goes live. I didn't find that something, so I built it: ChatFlowGate.</p> <h2> What it actually does </h2> <p>Point a bot at your n8n webhook URL and ChatFlowGate becomes the only thing that ever touches it. The browser talks to ChatFlowGate; ChatFlowGate talks to n8n.</p> <ul> <li> <strong>Hidden webhook</strong> — the URL is a server-side database field, never sent to the client.</li> <li> <strong>Signed, bot-bound sessions</strong> — visitors get an HMAC-SHA256 token scoped to one bot, expiring in 24h, issued only after the parent page's origin is checked against that bot's domain allowlist.</li> <li> <strong>Rate limiting</strong> — token-bucket limits per session and per IP, tunable per bot, resolved from a trusted proxy hop so a spoofed X-Forwarded-For can't dodge it.</li> <li> <strong>SSRF guard</strong> — webhook targets are DNS-resolved and rejected if they point at loopback, private, link-local, or cloud metadata addresses, checked again at connect time, not just when you save the bot.</li> <li> <strong>Spam traps</strong> — hidden honeypot fields in the widget forms that a real visitor can't see or tab to. A bot filling them in gets a normal-looking response and nothing else happens: no webhook call, no charge.</li> <li> <strong>No message storage</strong> — chat text is never written to the database. One row per session holds IP, coarse location, browser/OS, and a message count. That's the entire analytics story.</li> <li> <strong>Streaming</strong> — n8n's reply (NDJSON, SSE, or a single JSON body) is parsed and streamed back to the widget token by token.</li> <li> <strong>Multi-tenant</strong> — bots, sessions, and API keys are scoped to a workspace, so an agency can run one bot per client from a single account, each pointed at a different n8n workflow, each with its own branding.</li> </ul> <h2> Try it </h2> <p>There's a live demo on the homepage — a real bot through the real gateway, rate limits and session tokens included, not a scripted mockup:</p> <p><a href="https://www.chatflowgate.com" rel="noopener noreferrer">https://www.chatflowgate.com</a></p> <p>Embedding is one script tag:</p> <p><code>&lt;script src="https://www.chatflowgate.com/embed.js" data-bot="YOUR_BOT_ID" defer&gt;&lt;/script&gt;</code></p> <p>Free to start, no card required. It's early — a handful of real users so far — so if you build with n8n, I'd genuinely value you trying it and telling me what's missing or what breaks.</p> n8n security automation ai Louis Madrigal Sun, 02 Aug 2026 16:41:17 +0000 https://dev.to/louis2688/-4c48 https://dev.to/louis2688/-4c48