Throw if IsSkillClaim and claimsValidator is null (#2761)

microsoft · Sep 4, 2020 · c2d39e2 · c2d39e2
1 parent b72ac29
commit c2d39e2
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/libraries/botframework-connector/src/auth/jwtTokenValidation.ts b/libraries/botframework-connector/src/auth/jwtTokenValidation.ts
@@ -132,6 +132,9 @@ export namespace JwtTokenValidation {
         if (authConfig.validateClaims) {
             // Call the validation method if defined (it should throw an exception if the validation fails)
             await authConfig.validateClaims(claims);
+        } else if (SkillValidation.isSkillClaim(claims)) {
+            // Skill claims must be validated using AuthenticationConfiguration validateClaims
+            throw new AuthenticationError('Unauthorized Access. Request is not authorized. Skill Claims require validation.', StatusCodes.UNAUTHORIZED); 
         }
     }