Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create a custom endpoint for generate a Direct Line token #139

Closed
MrDave1999 opened this issue Jan 16, 2023 · 0 comments · Fixed by #142
Closed

Create a custom endpoint for generate a Direct Line token #139

MrDave1999 opened this issue Jan 16, 2023 · 0 comments · Fixed by #142
Labels
feature New feature or request security Issue or pull request related to application security

Comments

@MrDave1999
Copy link
Member

It is necessary to create an endpoint that is responsible for calling the DirectLine API to generate a token and this is because if it is done from the client, the secret key would be exposed, this brings as a consequence that any malicious user could access any conversation associated with the bot.

The solution is to create a service on the back-end side in which it is in charge of making a request to the next endpoint:

POST https://directline.botframework.com/v3/directline/tokens/generate
Authorization: Bearer SECRET_KEY

This can be done on the front-end side but it would be insecure.

@MrDave1999 MrDave1999 added security Issue or pull request related to application security feature New feature or request labels Jan 16, 2023
@MrDave1999 MrDave1999 added this to the v1.0.0 milestone Jan 16, 2023
@MrDave1999 MrDave1999 removed this from the v1.0.0 milestone Jan 21, 2023
@MrDave1999 MrDave1999 linked a pull request Jan 23, 2023 that will close this issue
@github-project-automation github-project-automation bot moved this from To Do to Done in DentallApp (first stage) Jan 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature or request security Issue or pull request related to application security
Projects
No open projects
Development

Successfully merging a pull request may close this issue.

1 participant