PR #35374: fix: prevent Chrome mobile permission prompts on embedded chat widget

• Repository: langgenius/dify
• Author: DanKunleLove
• State: open | merged: False
• Link: https://github.com/langgenius/dify/pull/35374

Description (problem / solution / changelog)

Summary

Fixes #35330 — the embedded chatbot bubble widget triggers Chrome mobile permission prompts ("access to apps and services") instead of rendering, because the iframe unconditionally requests microphone permission.

Root cause

web/public/embed.js line 159:

iframe.allow = "fullscreen;microphone";

On Chrome mobile, requesting microphone in the iframe allow attribute triggers a browser permission prompt even when the chat doesn't use audio input. This blocks the widget from rendering until the user grants permission.

Changes

• Make microphone permission opt-in via enableMicrophone config flag in difyChatbotConfig (defaults to false)
• Fix allow attribute syntax — use space-separated format per the Permissions Policy spec ("fullscreen; microphone" not "fullscreen;microphone")
• Update iframe embed example in the sharing modal to only request fullscreen by default
• Update both embed.js and embed.min.js

Usage

Users who need microphone access (e.g., for voice input) can opt in:

window.difyChatbotConfig = {
  token: 'your-token',
  enableMicrophone: true
}

Test plan

• Embed chat widget on a test page without enableMicrophone — verify no permission prompt on Chrome mobile
• Embed chat widget with enableMicrophone: true — verify microphone permission works when needed
• Verify widget renders correctly on desktop browsers (Chrome, Firefox, Safari)
• Verify existing chat functionality is unaffected (text input, responses)

Fixes #35330

Changed files

• web/app/components/app/overview/embedded/index.tsx (modified, +1/-1)
• web/public/embed.js (modified, +7/-1)
• web/public/embed.min.js (modified, +1/-1)