AWS connect: Chat widget custom identifier now requires JWT claims
Summary
Removes the documented option to pass a custom user identifier as a positional argument during ClickStream tracker initialization, and instead requires setting the customerId field in JWT claims with widget security enabled, adding an example JWT payload.
Security assessment
The diff deletes the client-side initialization path (`await window.amazon_connect.Web.ClickStream.init('<custom-user-id>')`) that let a caller supply an arbitrary customer identifier, and replaces it with a signed JWT claim (`customerId`) that requires widget security to be enabled. This closes an unauthenticated identity-spoofing/impersonation path for linking clickstream data to customer profiles, so it is a concrete authentication/authorization hardening change.
Evidence
+To provide a custom identifier, set the `customerId` field in your JWT claims. You must enable security on your Communications widget before you can use this field. For instructions on enabling security, see [Step 3: Confirm and copy communications widget code and security keys](./add-chat-to-website.html#confirm-and-copy-chat-widget-script).
Diff
diff --git a/connect/latest/adminguide/chat-widget-data-tracker.md b/connect/latest/adminguide/chat-widget-data-tracker.md index b5e4d0f..663e866 100644 --- a//connect/latest/adminguide/chat-widget-data-tracker.md +++ b//connect/latest/adminguide/chat-widget-data-tracker.md @@ -207,8 +207 @@ If you don't need to link to an existing profile but want to group clickstream a -There are two ways to provide it: - - * **Via JWT claims** – Set the `customerId` field in your JWT claims (requires security enabled). - - * **Via initialization** – Pass the identifier as an argument when initializing the tracker: - - // Pass the custom user id as a positional string argument. - await window.amazon_connect.Web.ClickStream.init('<custom-user-id>'); +To provide a custom identifier, set the `customerId` field in your JWT claims. You must enable security on your Communications widget before you can use this field. For instructions on enabling security, see [Step 3: Confirm and copy communications widget code and security keys](./add-chat-to-website.html#confirm-and-copy-chat-widget-script). @@ -215,0 +209 @@ There are two ways to provide it: +The following example shows a JWT payload with the `customerId` field: @@ -217,0 +212,6 @@ There are two ways to provide it: + { + "sub": "<widgetId>", + "iat": 1234567890, + "exp": 1234571490, + "customerId": "<custom-user-id>" + }