CODEWITHSUNDEEP
botframework
sudo007
sudo007

Reputation: 13

Https/BotAuthentication breaking botframework bot?

I am having an issue with trying to create a bot. Everything seems to work fine when I am using Http. I can deploy my application to my website and interact with the bot via the emulator or botframework.com.

Unfortunately, when I try to use HTTPS, I get a 401 error from the emulator and nothing shows up when I try to use botframework.com.

Just so that I am crystal clear, the only things that I changed are: 1. Added the [BotAuthentication] attribute to my ApiController like so:

[BotAuthentication]
public class MessagesController : ApiController
  1. Updated the URL in the emulator/botframework.com from http://mywebsite.com/api/messages to https://mywebsite.com/api/messages

Web.config is all set up with the appId and AppSecret. My site already has an SSL certificate.

Is there anything that I am missing? Although I have never used basic authentication before I am assuming there is nothing else that I need to set up, right?

Upvotes: 1

Views: 651

Answers (2)

T Laird-McConnell
T Laird-McConnell

Reputation: 416

I hit your endpoing and IIS is responding to the basic auth and getting in the way.

Basic Auth is works the following way: There is a header which contains the UserId:Password encoded as base64 If the server doesn’t see the header it returns a 403 with a “basic” to signal that the web site requires auth token. For a web browser that means it will popup a stock user/password dialog and then it will do submit the request again with the header. If the header is provided but the user/password is wrong the server returns 401.

Normally basic auth is used to look up in a database, but in our case there is only 1 user, it is the bot appid/appsecret. All the BotAuthorization attribute does is to add an inspector to the request pipeline to look for the header with appid/appsecret in it to make sure that only approved callers can call your bot.

If you don’t care about that you can simply remove the attribute. Regardless, you don’t want IIS sticking it’s nose into the process.

Make sense?

Upvotes: 1

Jim Lewallen
Jim Lewallen

Reputation: 1006

This theoretically should work based on your description of the changes you've made. This is the emulator talking to your cloud service or to the bot on localhost? And you get this error as well from the Bot Framework test control in the portal?

If you send me your BotId to [email protected] I can check our logs to see if there's anything interesting (or DM me at @jameslew on twitter).

Upvotes: 0

Related Questions