Incoming Webhook security
So far, I've not found any information on the topic of incoming webhook and actionable messages security, specifically - I'd love to be able to have any authorization required to post to the incoming webhook or limit the possible Actionable Message url target to just my company domain. Right now, I am afraid that if the incoming webhook address leaks outside the company, someone will be able to send Actionable Message form, which will send sensitive info outside of my company.
Jacek
shared this idea
3 comments
-
Rami
commented
Do we know how to secure incoming webhooks on MS Teams yet? This really makes the webhook unusable if it not secure.
-
Bradley Stein
commented
We also cannot find if there is ANY way to secure an incoming web-hook.
In theory, this means that the security hole here is somewhere between a nuclear bomb and a universe destroying black hole.
Can someone from MS chime in as to whether it is even possible to secure an incoming web-hook so that you can control who is allowed to call it.
-
Anonymous
commented
When it will be addressed?