Reject unauthenticated requests when no credentials are configured#530
Merged
Conversation
Previously, an empty ClientId silently triggered the bypass policy alongside the explicit skipAuth opt-in. That left unauthenticated requests accepted by default for any deployment that forgot to configure credentials. Splits the condition: skipAuth still bypasses, but a missing ClientId without skipAuth now fails closed. Callers that intentionally want the bypass (local dev without credentials) pass skipAuth: true to AddTeams(...).
Contributor
There was a problem hiding this comment.
Pull request overview
This PR changes the ASP.NET Core Teams token auth policy configuration to fail closed when no Teams credentials are configured, instead of silently bypassing auth when ClientId is missing. This aligns the .NET behavior with the referenced TypeScript/Python changes and prevents accidentally deploying with authentication disabled due to missing configuration.
Changes:
- Split the existing “bypass auth” condition so that only
skipAuth: truebypasses authorization. - When
Teams:ClientIdis empty andskipAuthis not set, configure the policy to reject all requests.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
singhk97
approved these changes
May 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AddTeamsTokenAuthenticationcurrently engages theRequireAssertion(_ => true)bypass policy wheneverskipAuth: trueis passed or the configuredClientIdis empty. That means an emptyClientIdsilently disables auth for any deployment that forgot to set credentials, with no opt-in.This change splits the condition:
skipAuth: truestill bypasses, but a missingClientIdwithoutskipAuthnow fails closed (RequireAssertion(_ => false)). Callers that intentionally want unauthenticated local development passskipAuth: truetoAddTeams(...).Aligns with the equivalent change in TypeScript (microsoft/teams.ts#506) and Python (microsoft/teams.py#360).
Test plan
ClientIdis empty andskipAuthis not setskipAuth: trueis explicitly passed with emptyClientIdskipAuth: trueis set