Skip to content

Function: isAllowedServiceUrl()

isAllowedServiceUrl(serviceUrl, tokenServiceUrl?): boolean

Whether serviceUrl is one replies may be sent to.

Only ever the host the verified token was issued for. A Bot Service token is a bearer credential, so honoring the serviceUrl from the request BODY would let a replayed token point the bot’s authenticated replies (and its token) at an attacker-controlled host. When the token carries no serviceurl claim the body value is accepted but restricted to Microsoft’s own domains.

string

string

boolean