copilot-chat ChatHistory controller neither authenticates nor validates message ownership

[IanNorris]

Describe the bug The ChatHistory endpoint is unauthenticated and it is possible to interact with the backend API without any kind of authentication.

It is also possible to query and access chat messages for other users.

To Reproduce Steps to reproduce the behavior:

1. Access https://localhost:40443/chatSession/getAllChats/<AAD object ID>.<Tenant ID>
2. This will list all conversations for any user you know the object ID of

Expected behavior The ChatHistory controller is missing an [Authorize] attribute, and the endpoints should validate that the user requesting the messages owns or has access to them.

[cchighman]

Nice call out, lol, but I think there are several notes that indicate not to use this for production and since the sample app is meant to convey the novelty behind using SK for the copilot use case, I probably wouldn't expect the sample app to articulate further with assumptions on a security implementation.

That's my take, I'm a consumer just like you.

[dedalo]

As the team is open to PR, I think it would be a great addition if you could make it work.

[parthvnp]

@IanNorris @dedalo Happy to contribute a PR to this.

[hathind-ms]

@parthvnp - Yes, we are open to PRs and would be great if you can contribute.

[parthvnp]

@hathind-ms Thanks. I will start working on a fix.

[gitri-ms]

This has been fixed with https://github.com/microsoft/chat-copilot/pull/126