Prevent the user from not being able to use the chatbot if not authenticated about back-end

[MrDave1999]

The solution was easier than I thought. There is no need to pass any security token to the bot.

The only thing to do is to link the user ID in the Direct Line token, that way, Direct Line can perform an additional validation, as described in the documentation:

Direct Line can perform additional security validation of the user ID and name, inhibiting tampering of these values by malicious clients.

This means that Direct Line will use the user ID attached to the token, regardless of whether a malicious user tries to alter it.

However, there is a problem, the person ID (the identification of a user's personal information) field is still manipulable. Any malicious user can modify this field. So the proposed solution is to embed the person ID together with the user ID in the Direct Line token.

Example:

{
  "user": {
    "id": "dl_{userID}-{personID}",
  }
}

{userID} and {personID} must be replaced by their respective IDs. Then, on the bot side, can add a code that is in charge of performing a split to obtain the IDs.
If this process is not performed, a malicious user may provide their own person ID and attempt to schedule an appointment for another user without their consent.