question

BillyGraham-8807 avatar image
0 Votes"
BillyGraham-8807 asked JimmyYang-MSFT commented

Unauthorized user access (Account takeover) issue

Hi,

We are not able to get our app to work on Teams tab using session. The app works only when we validate with all parameters. Let me give an example:

We are not able to use the URL in this format with session: https://abc.com/Teams/feedback

We are forced to use the below format:

https://abc.com/Teams/feedback?userId=&emailId=xyz@xyz.com.com&subscriptionId=&tenantId=----&signedInUserId=--&isSubscriber=*

Can you please help us out on this?

Thanks,

Billy

office-teams-windows-itprooffice-teams-app-dev
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Are you trying to authenticate user in teams tab? are you not able to load the page when you use URL like https://abc.com/Teams/feedback? Could you please explain your scenario in more detail?

0 Votes 0 ·
JimmyYang-MSFT avatar image
0 Votes"
JimmyYang-MSFT answered JimmyYang-MSFT commented

Hi @BillyGraham-8807,

Are there any error messages when you use the first URL? Could you provide your screenshot about this issue?

Can you load the page well when you use the URL https://abc.com/Teams/feedback?

I also did a test in my environment and it can load well. If you want to authenticate your account in your page, maybe you can try to print this URL like the following picture:

73662-24.png


Result:

73663-25.png


If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.



24.png (16.9 KiB)
25.png (49.3 KiB)
· 6
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @BillyGraham-8807,

Any update?

0 Votes 0 ·

Hi Jimmy, Sorry for the delay.

Let me explain the problem in detail. The way our app is set up is very similar to Microsoft Planner. It is built on .Net as a web based app and we run it on Teams tab through the app store.

When we did a penetration test, 'Unauthorized user access (Account takeover)' issue came up. Remediation suggested is: Session id should be validated across each sessions. New session Id must be created for each login and old session id should not be reused.

We are not able to use session when our app loads on Teams tab. We also released that when the app loads on Teams tab - it sits behind iframe. We are not able to use session on iframe. Because we are not able to use session - we are passing all the required data through parameters and this is allowing account takeover.

0 Votes 0 ·
Show more comments
NikithaMSFT-0176 avatar image
0 Votes"
NikithaMSFT-0176 answered NikithaMSFT-0176 edited

Loading an website is not supported by teams. You need to add a tab and add the authentication to Application. Could you please check this docs and sample for more info?

Thanks,

Nikitha.


If the response is helpful, please click "Accept Answer" and upvote it. You can share your feedback via Microsoft Teams Developer Feedback link. Click here to escalate.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.