CC: Restrict API key auth for service-to-service #1639
Assignees
Labels
sk team issue
A tag to denote issues that where created by the Semantic Kernel team (i.e., not the community)
Comments
alliscode
added
the
sk team issue
alliscode
moved this from Backlog – Copilot Dev UX
to Ready
in Apps & Services Semantic Kernel
4 tasks
4 tasks
4 tasks
4 tasks
github-merge-queue bot
pushed a commit
to microsoft/chat-copilot
that referenced
this issue
Aug 18, 2023
### Motivation and Context This PR addresses microsoft/semantic-kernel#1639. It is a combination of PRs #92 and #110 ### Description #### Backend changes - Remove API key authorization - Use "AzureAD" as default authentication configuration for deployments, "None" for running locally (Note: UI changes to disable sign in flow for the latter case are still forthcoming) - Enable auth policy on controllers that checks if the user is part of the conversation they are trying to access This PR changes the contract between the frontend and backend around how user IDs are communicated. Users who have been signing into the frontend with AAD will now only see their chats if the backend is also gated by AAD authentication, which was not the case previously. #### Frontend changes - adds `REACT_APP_AUTH_TYPE` and changes AAD variables in `.env` to be optional - adds `AuthHelper.IsAuthAAD` to conditionally render different elements throughout the app - changes user settings menu popup to instead just show as a settings button:  Existing users will need to uncomment `REACT_APP_AUTH_TYPE=AzureAd` in `webapp/.env` to continue using AAD as their authorization type. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [x] The code builds clean without any errors or warnings - [x] The PR follows the [Contribution Guidelines](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/copilot-chat/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄 --------- Co-authored-by: Desmond Howard <[email protected]>
|
This has been fixed with microsoft/chat-copilot#126 |
github-project-automation
bot
moved this from In progress
to Done
in Apps & Services Semantic Kernel
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Exposing an API key in a browser client is not recommended.
Reference: Fix security issues in copilot chat app by DavidParks8 · Pull Request #1090 · microsoft/semantic-kernel (github.com)
The text was updated successfully, but these errors were encountered: