Forum Discussion
How to pass trusted Origin in Directline enhanced authentication
I am working on a direct line channel with Bot framework. I am getting the magic code every time when i do sign in with Oauth prompt.
As per the document we need to pass trusted origins in direct-line client. So I have tried by giving the ui url of web application. But still I am getting the magic token in all the browsers including Chrome , Firefox and Safari.
Can you please help on this
13 Replies
andrewclearMicrosoft
It appears that you are entering the incorrect domain for your trusted origin - it needs to be the domain that is hosting the webchat client. Additional information can be found in the documentation here: https://docs.microsoft.com/en-us/azure/bot-service/bot-builder-security-enhanced?view=azure-bot-service-4.0
In trusted origin we have provided the UI link for web application where we have hosted and enhanced authentication is working in Chrome, its not asking for magic token.
But in Chrome incognito , some times it shows magic token after sign in . Every time magic token is displayed in Firefox and safari .
Also tried the below urls but still its showing validation code after every login
Prasad_Das-MSFTAre 3rd party cookies enabled?
They are required in order to eliminate the magic code flow https://github.com/microsoft/BotFramework-WebChat/issues/4274
- Prasad_Das-MSFT
You may be able to achieve this by adding an Azure CLI task to your pipeline.
From here you have two options:
1) Use the
az resource updatecommand:az resource update --name web --resource-group myResourceGroup --namespace Microsoft.Web --resource-type config --parent sites/<app_name> --set properties.cors.allowedOrigins="['http://localhost:5000']" --api-version 2015-06-01Tutorial: Host RESTful API with CORS - Azure App Service | Microsoft Docs
2) Use the
az webapp corscommand:az webapp cors add -g {myRG} -n {myAppName} --allowed-origins https://myapps.comaz webapp cors | Microsoft Docs
Thanks,
Prasad Das
--------------------------------------------------------------
If the response is helpful, please click "**Mark as Best Response**" and like it. You can share your feedback via Microsoft Teams Developer Feedback link. Click here to escalate
We have tried the Second option by updating the url of web app in which the application is hosted and also tried the below urls,
https://login.microsoftonline.com
https://directline.botframework.com
https://token.botframework.com
But still its not working.
Can we know which are the trusted origins we need to provide.
- Prasad_Das-MSFT
Lakshmi_145 -With enhanced authentication options, you can statically specify the trusted domains (trusted origins) list in the Direct Line configuration page.
Connect a bot to Direct Line in Bot Framework SDK - Bot Service | Microsoft Docs
