Bot-docs: Customer Doesn't Want to Whitelist "*.botframework.com"

[gamullen]

Our customer's security team won't let them whitelist a URL with an asterisk; only concrete URLs or a concrete range of IPs.

Can one of those be provided for "botframework.com"?

Thanks, Gary

[zxyanliu]

Hi @gamullen Thanks for reporting. I was wondering if there is any document you or your customer's security team is referring to?

[gamullen]

Sorry, not sure how that comment didn't get associated with the page. This: https://docs.microsoft.com/en-us/azure/bot-service/bot-service-resources-bot-framework-faq?view=azure-bot-service-4.0

[zxyanliu]

Hi! Thanks for your reply. We are coordinating with our engineering team for this issue. Will let you know shortly.

[mdrichardson]

@gamullen *.botframework.com is preferred and certainly more future-proof (in case we change the names or something), but you should be able to get away with using token.botframework.com and <channel>.botframework.com, where <channel> is equal to every channel that your bot uses, for example:

• directline.botframework.com
• webchat.botframework.com
• slack.botframework.com
• etc

That should cover your needs, but it might be worthwhile to watch traffic over your firewall while testing the bot to make sure something else isn't getting blocked.

[gamullen]

Great, thanks! Will that be making its way into the documentation?

[zxyanliu]

I can add the content into the documentation. @gamullen @mdrichardson

[CoHealer]

@zxyanliu , is there an eta on the document update so we can close this issue?

[zxyanliu]

Hi @CoHealer
Yes, it is fixed in PR 1927. @mdrichardson helped a lot and reviewed the PR. I will close this issue when 1927 get merged.

[CoHealer]

Great, thanks

[zxyanliu]

Closing the issue since the PR is merged and content will go live soon. @gamullen Thanks again!