LanternDocs
Sign up

Auth Gates

Auth gates control who sees the Lantern widget. By default, the widget only shows to authenticated CMS users — preventing regular site visitors from ever seeing it.

#Why auth gates exist

The widget is designed for agency workflows, where a small team of editors and developers review a client's site and report issues. You do not want random visitors to see a bug-reporting button — only the logged-in people who need it.

Auth gates use client-side detection to check whether the current visitor is logged into a supported CMS before showing the widget button.

#Supported gates

#WordPress

Detection method: Checks for the #wpadminbar element in the DOM.

WordPress adds a dark admin toolbar to the top of every page for logged-in users. This element (id="wpadminbar") is always present in the DOM for authenticated WordPress users, even if it is hidden with CSS.

Who sees the widget:

  • Logged-in WordPress users (admin, editor, author, etc.) browsing the frontend ✓
  • Logged-out visitors ✗
  • WordPress admin area (/wp-admin/) — the widget is not needed there and does not load

Edge case: If the admin bar is removed from the DOM entirely using add_filter('show_admin_bar', '__return_false'), the detection will fail. In this case, use the WordPress plugin which has additional detection mechanisms.

#Umbraco v17

Detection method: Checks for the UMB_PREVIEW or UMB-BACKOFFICE cookies set by Umbraco when a user is logged into the backoffice.

When a user logs into the Umbraco backoffice, Umbraco sets browser cookies that persist while their session is active. The widget reads these cookies to determine whether the current visitor is an authenticated backoffice user.

Who sees the widget:

  • Logged-in Umbraco backoffice users browsing the frontend ✓
  • Regular site visitors ✗

Note: This gate checks for cookies specific to Umbraco v17. If you are on an older version and the detection is not working, check with support.

#What happens when a gate check fails

If neither CMS gate is detected:

  • The widget does a validation check of the embed key (to confirm it's live)
  • But no widget button is injected into the page

The visitor sees nothing. No errors, no UI, no JavaScript errors in the console.

#Testing your gate

To test that the gate is working correctly:

  1. Visit the site logged out — the widget button should not appear.
  2. Visit the site logged into WordPress or Umbraco — the widget button should appear.

If the button always appears (even logged out), check that:

  • The CMS is outputting the expected DOM elements or cookies
  • The script tag is loading correctly

If the button never appears (even logged in), check that:

  • You are testing on the frontend of the site, not the CMS admin area
  • The correct session indicators are present (see per-CMS notes above)

#Custom integrations

The widget is built to be extended. If you are using a CMS or authentication system that is not natively supported, contact support to discuss custom gate options.

#Script tag example

html
<!-- Widget only shows to logged-in WordPress or Umbraco users -->
<script
  src="https://lanternhq.app/widget.js"
  data-key="YOUR_EMBED_KEY_HERE"
  defer
></script>

No additional configuration is needed to enable auth gates — they are active by default when the script detects a supported CMS.