Get token without exposing secret publicly in Javascript about botframework-directlinejs

[billba]

@seca23 that is extremely helpful, thank you!

[seca23]

I know this is an old thread, but here is a C# version for obtaining a token:

protected string file_get_contents(string url)
{
    var contents = "";
    if (url.ToLower().IndexOf("https:", StringComparison.Ordinal) > -1)
    {
        var wc = new System.Net.WebClient();
        var directlineSecret = ConfigurationManager.AppSettings["DirectlineSecret"].ToString();
        wc.Headers = new WebHeaderCollection {{"Authorization", string.Format("BotConnector {0}", directlineSecret) }};
        var response = wc.DownloadData(url);
        contents = System.Text.Encoding.ASCII.GetString(response);
    }
    else
    {
        var sr = new System.IO.StreamReader(url);
        contents = sr.ReadToEnd();
        sr.Close();
    }
    return contents;
}

[billba]

You would have to do this is in a web site you control.

…

________________________________ From: Ivan <[email protected]> Sent: Thursday, August 3, 2017 7:16:56 AM To: Microsoft/BotFramework-DirectLineJS Cc: Subscribed Subject: [Microsoft/BotFramework-DirectLineJS] Get token without exposing secret publicly in Javascript (#38) I'm creating custom chat window on a wordpress site (hosted outside Azure) for my bot using Direct line connector and Javascript, and to start conversation I need to specify Direct line SECRET or a TOKEN for my bot app. To get a token i have to make a REST call to https://directline.botframework.com/v3/directline/tokens/generate<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdirectline.botframework.com%2Fv3%2Fdirectline%2Ftokens%2Fgenerate&data=04%7C01%7CBill.Barnes%40microsoft.com%7C56ee202bca364c80ce9608d4da7a4da0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636373666202458028%7CUnknown%7CVW5rbm93bnx7IlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiT3RoZXIifQ%3D%3D%7C-1&sdata=yi9Bt5b2twNe6Li3w%2FCIqBAkrB6%2FMzVE%2FNfovBP79h0%3D&reserved=0> and add to header "Authorization : Bearer SECRET". I don't want to expose that SECRET publicly in my javascript file and I don't want to pass it as a URL parameter. What are my other options? How to get token without exposing my bot Direct line SECRET to client? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoft%2FBotFramework-DirectLineJS%2Fissues%2F38&data=04%7C01%7CBill.Barnes%40microsoft.com%7C56ee202bca364c80ce9608d4da7a4da0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636373666202458028%7CUnknown%7CVW5rbm93bnx7IlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiT3RoZXIifQ%3D%3D%7C-1&sdata=7s3Xvwzfwwc22VkQRANk8EHW%2Fe9%2BmzfSCf7gJhhYCU8%3D&reserved=0>, or mute the thread<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAKietzSGCoraS72EddefjYm6I3vapWZPks5sUdZYgaJpZM4OsgSL&data=04%7C01%7CBill.Barnes%40microsoft.com%7C56ee202bca364c80ce9608d4da7a4da0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636373666202458028%7CUnknown%7CVW5rbm93bnx7IlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiT3RoZXIifQ%3D%3D%7C-1&sdata=UMKq6sbLzD9Iq9xyrR8RMCQUM1VnswVbhMuxM749AOA%3D&reserved=0>.

[hkusulja]

@billba so Microsoft Example is to put secret inside JavaScript file. But you are telling that it should be used only by server backend which will obtain token and pass it to the JavaScript? What is best practice for public web site with Microsoft Bot ?

[billba]

There are many scenarios where publishing the secret is no problem. All it really means is that anyone can put your bot on their web site. If what you want is for people to use your bot, that might be okay.

If you don't wish to publish your secret, then best practice is to have your website get it, and inject the token directly into the javascript of the web page it publishes. In this code, botchattest gets a token in the act of creating the web page containing WebChat.

Closing this issue.

[seca23]

@Hrcinjo

You can generate a token in WordPress with PHP like this:

<?php

/* This code is used to generate a token, that is only valid for a single conversation,
 * this prevents other developers from including your bot in their website. By 
 * restricting their access to your bot secret. 
 */

$botSecret = 'Your bot secret';

$response = wp_remote_get( 'https://webchat.botframework.com/api/tokens', array( 'headers' => 'Authorization: BotConnector ' . $botSecret ) );
if( is_array($response) ) {
  $header = $response['headers']; // array of http header lines
  $token = $response['body']; // use the content
}

?>

If you want to do this in a non WordPress site, you can do it like this:

$botSecret = 'Your bot secret';

$options = array('http' => array(
    'method' => 'GET',
    'header' => 'Authorization: BotConnector ' . $botSecret
));

$context = stream_context_create($options);

$token = file_get_contents('https://webchat.botframework.com/api/tokens', false, $context);

?>