GX Technology : Chatbot - Security - v2.1

Overview

The addition of webhook support so that Dialogflow may populate responses based on data from other services. The primary motivator is the ability to search for supported movie titles in the Movies Anywhere virtual agent.

Team

Requirements

The webhook endpoint is constrained by Dialogflow requirements. As such, the webhook must be an HTTPS endpoint exposed publicly, consuming and producing Dialogflow-defined models in JSON format. CORS filtering will need to be disabled on the webhook endpoint^[1]. To prevent unauthorized use, HTTP Basic authentication will be employed.

[1] At time of development, Dialogflow did not support custom headers for webhook calls. Custom headers are now supported, but CORS constraints are not honoured by Dialogflow and only provide "security through obscurity" benefits.

Source Code Repository

Client: https://github.wdig.com/GXTech/chat-client.git
Server: https://github.wdig.com/GXTech/chatbot-server.git

Platform

Overview

Components Used

• Google App Engine, Java 8 Standard Environment
• Google Cloud SQL, version 2
• Google Data Loss Prevention API
• GlobalScape EFT Server
• Domo
• Bifrost Title Search

Google App Engine

Google App Engine will be used to server the existing APIs as well as the webhook. The webhook will run as part of the API service known as v1. The monitoring for the service has remained unchanged.

Google Cloud SQL

The Google Cloud SQL database has been updated to include new tables to store the extended payload data, in JSON format, as required by the new Carousel payload type.

Google Data Loss Prevention API

Google's Data Loss Prevent API will continue to be used to prevent the dissemination of PII.

GlobalScape EFT Server

GlobalScape EFT server is no longer the primary report destination. It is only used if there is no configuration for Domo or if one of the custom report endpoints are used.

Domo

Chatbot v2.0 updated the primary report destination to be Domo

Bifrost Title Search

The specific implementation of the Dialogflow webhook will connect to the Bifrost Title Search API.

New APIs

• POST /v1/product/{product}/webhook/dialogflow
  • Consumes Dialogflow's WebhookRequest in JSON format
  • Produces Dialogflow's WebhookResponse in JSON format

Threat Model