Function: isAllowedServiceUrl()
isAllowedServiceUrl(
serviceUrl,tokenServiceUrl?):boolean
Whether serviceUrl is one replies may be sent to.
Only ever the host the verified token was issued for. A Bot Service token is a
bearer credential, so honoring the serviceUrl from the request BODY would
let a replayed token point the bot’s authenticated replies (and its token) at
an attacker-controlled host. When the token carries no serviceurl claim the
body value is accepted but restricted to Microsoft’s own domains.
Parameters
Section titled “Parameters”serviceUrl
Section titled “serviceUrl”string
tokenServiceUrl?
Section titled “tokenServiceUrl?”string
Returns
Section titled “Returns”boolean