Secret leaks often occur when a sensitive piece of authentication data is stored with the source code of an application. Considering the source code is intended to be deployed across multiple assets, including source code repositories or application hosting servers, the secrets might get exposed to an unintended audience.

Why is this an issue?

In most cases, trust boundaries are violated when a secret is exposed in a source code repository or an uncontrolled deployment environment. Unintended people who don’t need to know the secret might get access to it. They might then be able to use it to gain unwanted access to associated services or resources.

The trust issue can be more or less severe depending on the people’s role and entitlement.

What is the potential impact?

Azure Bot Framework secrets and tokens are two distinct pieces of information.
They are both used to authenticate and authorize access to the Azure Bot Framework, but they are different in nature.
Both are used to authenticate and authorize access to the Azure Bot Framework, but tokens are short-lived and generated by the Azure Bot Framework, by using a secret.

Microsoft recommends using tokens instead of secrets because of their short lifespan but note that using them will not completely prevent other developers from embedding your bot in their websites. It just does make it difficult for them to do so, and skilled people can still have the patience to make something work.

Generally, we recommend not hardcoding secrets and tokens in your code.

Below are some real-world scenarios that illustrate some impacts of an attacker exploiting these secrets and tokens.

Bot theft or impersonation

An attacker can use leaked Azure Bot Framework tokens and secrets to use your bot for their own business purposes, leading to competition with your own bot and potential financial or reputational damages to your organization.

Compromise of sensitive personal data

This kind of service is often used to exchange information that could include personal information, chat logs, and other private data that users have shared on the platform. This is called Personally Identifiable Information.
The leaked app key could provide a gateway for unauthorized individuals to access and misuse this data, compromising the privacy and safety of the application users.

In many industries and locations, there are legal and compliance requirements to protect sensitive data. If this kind of sensitive personal data gets leaked, companies face legal consequences, penalties, or violations of privacy laws.

Financial loss

Financial losses can occur when a secret is used to access a paid third-party-provided service and is disclosed as part of the source code of client applications. Having the secret, each user of the application will be able to use it without limit to use the third party service to their own need, including in a way that was not expected.

This additional use of the secret will lead to added costs with the service provider.

Moreover, when rate or volume limiting is set up on the provider side, this additional use can prevent the regular operation of the affected application. This might result in a partial denial of service for all the application’s users.

How to fix it

Revoke the secret

Revoke any leaked secrets and remove them from the application source code.

Before revoking the secret, ensure that no other applications or processes are using it. Other usages of the secret will also be impacted when the secret is revoked.

Use Azure DirectLine enhanced authentication

Use Microsoft production embedding options to embed your bot in websites and follow the best practices to secure your bot that Microsoft mentions in the Direct Line API documentation.

The goal is to make sure the code you embed in your user-facing front-end page cannot be reused by other developers to embed your bot in their websites.

By using the "enhanced authentication" option, you can make sure the user ID on messages from Direct Line to your bot will always be the same as the one you initialized the Web Chat with and thus prevent other unwanted initiators.

Code examples

Noncompliant code example

The pages that contain the bot’s secret or token are publicly accessible mentionned by Microsoft should be avoided, unless you do not mind the risks associated with hardcoding these secrets.

<iframe
    src='https://europe.webchat.botframework.com/embed/SecretDetectionInBotFramework?s=JTYufYyH6Vg.x6PXQmNIDgrXaSQM8Mk0lNnudWz7z9Qffn7B5qwTWn4'
    style='min-width: 400px; width: 100%; min-height: 500px;'>
</iframe> <!-- Noncompliant -->

<!DOCTYPE html>
<html>
<body>
  <iframe id="chat" style="width: 400px; height: 400px;" src=''></iframe>
</body>
<script>

    var xhr = new XMLHttpRequest();
    xhr.open('GET', "https://webchat.botframework.com/api/tokens", true);
    xhr.setRequestHeader('Authorization', 'BotConnector ' + 'JTYufYyH6Vg.ihxXKebb9A9y0hxbSUNMrZrsOt06wGFibEkoJCt2kMw'); // Noncompliant
    xhr.send();
    xhr.onreadystatechange = processRequest;

    function processRequest(e) {
      if (xhr.readyState == 4  && xhr.status == 200) {
        var response = JSON.parse(xhr.responseText);
        document.getElementById("chat").src="https://webchat.botframework.com/embed/<botname>?t="+response
      }
    }

  </script>
</html>

Resources

=== Documentation

Standards