Hello @cuifangxu,
Thanks for assistance, I would like to confirm a few implementation details related to Same-Origin Policy and message handling for Dify + Chatflow:
1. Deployment — Same-Origin Policy
To address Same-Origin Policy restrictions, is it recommended to install Dify on the same server / environment as the website (for example, a local installation on the same host)? If not, what is the recommended approach (CORS, reverse proxy, or hosting Dify and the website under the same origin)?
2. Receiving messages in Dify / Chatflow
For receiving data posted from a parent window (via postMessage), do I need to add a window.addEventListener('message', ...) handler inside Dify, or will Dify automatically populate the required variables? If I must add the event listener, could someone provide a step-by-step example for integrating it with Dify/Chatflow? I am specifically using Chatflow and want to know the best way to accept and use incoming params (e.g., user_id, user_name, session_id).
FYI — example usually I use to get the postMessage value in my apps:
window.addEventListener('message', function(event) {
// Only accept messages from the expected origin
if (event.origin !== 'https://my-parent-domain.com') {
return;
}
if (event.data && event.data.type === 'DIFY_PARAMS') {
const receivedData = event.data.data;
console.log('Received user data from parent:');
console.log('User ID:', receivedData.user_id);
console.log('User Name:', receivedData.user_name);
console.log('Session ID:', receivedData.session_id);
} else {
console.log('Received a message, but it was not the DIFY_PARAMS type:', event.data);
}
}, false);
console.log('Iframe is listening for postMessages...');
Request: please advise if this approach is appropriate for Dify Chatflow and, if needed, provide a short step-by-step guide showing how to:
-
Add the message listener inside Dify/Chatflow,
-
Validate and map incoming fields into Dify variables or the Chatflow context, and
-
Any recommended security checks or best practices (origin validation, message shape validation, rejecting unexpected messages, using event.source when replying, etc.).
Thank you in advance for your help.
