LeadForge
LeadForge is a multi-tenant SaaS platform that lets any business embed an AI-powered chat widget on their website with a single script tag. Built on FastAPI and PostgreSQL, with Groq's LLM streaming responses over Server-Sent Events, the widget engages visitors in natural conversation, scores their intent automatically, and extracts contact details the moment they qualify — no static forms or manual follow-up required. A Next.js dashboard gives teams real-time visibility into every conversation and lead, while per-project domain whitelisting, JWT auth, and webhook integrations keep each organization's data isolated.
The Challenge
- The widget loaded fine locally but stayed invisible on real client sites — silently blocked by missing or mismatched CORS and Content-Security-Policy headers between the widget's origin and the host website's origin.
- A wildcard CORS policy wasn't an option, since the platform's domain-whitelisting feature depends on checking each request's origin against that project's approved domains to stop a leaked script tag or API key from being reused elsewhere.
- Cross-origin restrictions behave differently across browsers and host platforms (Chrome, Safari, Firefox, WordPress, Shopify), which made the failure inconsistent and hard to reproduce during debugging.
The Solution
We moved CORS handling into the FastAPI backend itself: each request's Origin header is checked dynamically against that project's whitelisted domains, and only a matching origin gets the correct Access-Control-Allow-Origin and CSP headers back. This let the widget render on any approved client domain while still blocking unauthorized use of a copied script tag or key, and cross-browser testing plus clearer console logging in the widget script made future embedding issues easy to catch instead of failing silently.