Power Platform Community Forum Thread Details

powerpages homepage Agent UI became a white screen.

If I disable web channel security in copilot studio, the bot on the homepage can connect to the service,

after ten minutes, it will automatically send a refresh token , then the server returns a 403 error, and the chat page will turn into a white screen.

If I enable web channel security, the bot will be unable to connect to the service.

So, is it necessary to enable web channel security?

If it's enabled, how can I configure it to allow the bot on the homepage to connect to the service?

If it's disabled, how can I prevent the bot on the homepage from sending refresh messages?

Categories:

General

Hello YY-28111024-0,

Thanks for posting this question in Q&A Forum.

I understand that your Power Pages chatbot is experiencing a white screen crash after 10 minutes (with a 403 error) when "Web Channel Security" is disabled, and it fails to connect entirely when security is enabled.

This behavior is caused by how the native Power Pages chatbot component handles the **Direct Line Token Refresh**. When security is disabled, the component attempts to refresh the session using a mechanism that fails (403 Forbidden) once the initial token expires (typically 10–15 minutes). When security is enabled, the component requires a secure token handshake that is not configured by default in the simple no-code setup.

Here are the answers to your specific questions and the recommended solution:

1. Is it necessary to enable Web Channel Security?

No. It is not mandatory for the bot to function on your homepage.
Why Enable it? It is a security best practice for production environments to prevent others from using your bot's ID on their own websites.
Why Disable it? For internal tools, public information bots, or development/testing, disabling it simplifies connectivity significantly.

2. How to fix the "White Screen" Crash (Recommended Solution)
Since the native Power Pages chatbot component has a known issue with handling token refreshes (causing the white screen), the most reliable fix is to **bypass the native component** and use an **IFrame** instead. This method handles the connection stability much better and prevents the crash.

Steps to implement the IFrame Workaround:

1. In Copilot Studio:

Go to Settings> Security > Web channel security.
Set "Require secured access" to Disabled.
Go to "Channels > Mobile app & Custom website.
Copy the Embed code (it looks like `<iframe src="..."></iframe>`).

2. In Power Pages Design Studio:

Open your homepage.
Delete the existing native "Chatbot" component that is crashing.
Add a Code component (or "Custom HTML" block).
Paste the IFrame code you copied from Copilot Studio.
Optional: Update the style to ensure it fits your page (e.g., `style="height: 500px; width: 350px;"`).

3. If you MUST enable Web Channel Security
If your organization's policy forces you to enable security, the bot will not work with the simple configuration. You must implement a Token Exchange backend.

Why it fails now: When "Require secured access" is On, the bot rejects connections that use the "Secret" directly. It requires a temporary "Token".
The Fix: You would need to set up a middleware (like an Azure Function or Power Automate Flow) that:
1. Holds your Direct Line Secret securely server-side.
2. Accepts a request from your Power Pages site.
3. Exchanges the Secret for a Token from Microsoft.
4. Returns the Token to your website to initialize the chat.

To fix the white screen issue immediately without complex coding, keep security Disabled and switch to the IFrame embed code.

If helps accept the answer.

Best Regards,
Jerald Felix

Quick Links