CORS and domains issues

[PeopleInside]

Hi remdex.

Yesterday I discovered an attack to my server: someone stolen from the page source code the Live Helper Chat Embed code and pasted it in a busy community.

From that moment I have my server busy of visits not mine.

Looking at the live helper chat guide I don't find how can I authorize multiple domains or.. I can found to use the * but this allow anyone to place my code in all external domains mine.

https://doc.livehelperchat.com/docs/integrating/#my-widget-does-not-work-i-have-live-helper-chat-installed-on-one-domain-but-code-is-embeded-on-another-domain

I'm also using a Plesk Panel who complicate a bit things because my server use Apache but also nginx for HTTP2.

MY QUESTION TO YOU:

I edited the .htaccess file inside live helper chat

<Files ~ "\.(gif|jpe?g?|png|bmp|swf|css|js|svg|otf|eot|ttf|woff|woff2|swf|mp3|ogg|wasm|wav|pdf|ico|txt)$">

SetEnvIf Origin "(http(s)?://localhost:8080)|(http(s)?://www.peopleinside.it)|(http(s)?://www.marcoborla.it)|(http(s)?://helpdesk.peopleinside.it)|(http(s)?://www.marcoborla.com)|(http(s)?://community.peopleinside.it)|(http(s)?://community.marcoborla.it)|(http(s)?://peopleinside.altervista.org|(http(s)?://peopleinside.it))$" AccessControlAllowOrigin=$0
    Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin


  Header always Set Access-Control-Allow-Methods: "GET, POST, OPTIONS, PUT, DELETE"
  Header always Set Access-Control-Allow-Headers: "Origin, X-Requested-With, Content-Type, Accept, API-Key, Authorization"
</Files>

Now if I visit www.peopleinside.it the chat widget is correctly showed.
If I visit www.marcoborla.it the widget is correctly showed.

If I visit https://helpdesk.peopleinside.it/it/ the widget is not showed but is showed if I open this single window in incognito.

Now that I removed the *I have this issue, visitor that from peopleinside.it go to helpdesk.peopleinside.it will not see the live chat widget.
I need just help to understand why this happen and how to avoid.

Thanks

[PeopleInside]

The strange think is that if you visit www.peopleinside.it then go on footer and click on the link marcoborla.com then also on that site click on marcoborla.it the widget always work.

If you go on peopleinside.it and under the top menu you goes with the mouse over the contact menu voice then click ticket, when a new tab is opened at helpdesk.peopleinside.it the widget is not visible.

Seems the issue is created if visitor move from a domain to a subdomain.
If helpdesk.peopleinside.it is opened alone using an incognito mode then the widget is visible but, if you click on portale link in the footer that will open peopleinside.it in a new tab, the widget on peopleinside.it will be not visible.

How can I resolve this issue?

Here is a video:
https://app.screencast.com/KmUBntkIAnvUV

[PeopleInside]

This screenshot may help you to answer and help me:

helpdesk.peopleinside.it

As you can see this is the developer tools console, I'm on peopleinside.it but the console show that the live chat has been blocked because is not helpdesk.peopleinside.it why I get this error if both peopleinside.it and helpdesk.peopleinside.it are allowed to show the widget chat?

How can I resolve?

I see the console error: ChunkLoadError

Looking in internet I find

How to Fix Chunk Load Error

As a user

If you are encountering this error as a user of an application, the most simple way to resolve it is to clear your browser cache (and also restart it for good measure) and try again. If the error was because your browser had cached older files, this should fix the issue. But if the problem is due to the chunk files, there’s nothing you can do except alert the application developers and wait till the problem has been fixed.

https://rollbar.com/blog/javascript-chunk-load-error/#

I'm looking for help

website that stole my LHC code link

[PeopleInside]

I found hot to resolve.
The following code placed in htaccess file resolve the issue

# DISABLE CACHING
<IfModule mod_headers.c>
    Header set Cache-Control "no-cache, no-store, must-revalidate"
    Header set Pragma "no-cache"
    Header set Expires 0
</IfModule>

<FilesMatch "\.(css|flv|gif|htm|html|ico|jpe|jpeg|jpg|js|mp3|mp4|png|pdf|swf|txt)$">
    <IfModule mod_expires.c>
        ExpiresActive Off
    </IfModule>
    <IfModule mod_headers.c>
        FileETag None
        Header unset ETag
        Header unset Pragma
        Header unset Cache-Control
        Header unset Last-Modified
        Header set Pragma "no-cache"
        Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
        Header set Expires "Thu, 1 Jan 1970 00:00:00 GMT"
    </IfModule>
</FilesMatch>

I found this from https://www.a2hosting.com/kb/developer-corner/apache-web-server/turning-off-caching-using-htaccess/