The chat room itself is a separate app hosted on its own domain
(website4u.vn),
so it can run its own backend independently of this static
GitHub Pages site. This page just embeds that app in an iframe.
It's a fully responsive page rather than a fixed mobile-sized
view, so it renders correctly at whatever size the iframe is
given, from a small popup-style box up to a full desktop window.
Messages sent from the chat get relayed to a private Discord
channel through a webhook/bot, so I can see and reply to them
from my phone or desktop without needing to keep this page open.
Since it's open to anyone with no login, it's built to hold up
against bots and abuse on its own: new conversations are
rate-limited per IP (max 5 per hour) with a site-wide daily cap as
a backstop against spam spread across many IPs, and each thread is
slowmode-limited to one message every few seconds. A thread also
starts locked: a visitor can type, but nothing actually sends until
I've replied at least once, so a bot can get at most one message
into Discord before being cut off, rather than flooding a thread
nobody's watching yet.
Session tokens are signed (HMAC) server-side, so a visitor can't
forge or guess their way into someone else's conversation, and
there's no database behind any of it either. A conversation's
entire state lives in its Discord thread, so there's nothing to
breach beyond that. Once the session is inactive for 8h, the chat
session ID will be automatically forgetten. Meaning I will no longer
be able to reach out to you unknown stranger. That chat history
however, will still be retained on Discord side, until I decided
to free it up.The embed itself is locked down too: the chat page
only renders inside an iframe on domains I've explicitly approved
from
website4u.vn, so it can't be silently framed on some other site.