Unauthorized user access (Account takeover) issue

Question

Hi,

We are not able to get our app to work on Teams tab using session. The app works only when we validate with all parameters. Let me give an example:

We are not able to use the URL in this format with session: https://abc.com/Teams/feedback

We are forced to use the below format:

https://abc.com/Teams/feedback?userId=***&emailId=xyz[@](/users/na/?userId=9628448e-7ffe-0006-0000-000000000000).com.com&subscriptionId=***&tenantId=\*\*\*\*\*\*-**-\*\*\*\*\*\*\*-\***-**&signedInUserId=\*\*\*\*-\*\*\*\*\*-**&isSubscriber=

Can you please help us out on this?

Thanks,

Billy

Answer 1

Hi @Billy Graham ,

Are there any error messages when you use the first URL? Could you provide your screenshot about this issue?

Can you load the page well when you use the URL https://abc.com/Teams/feedback?

I also did a test in my environment and it can load well. If you want to authenticate your account in your page, maybe you can try to print this URL like the following picture:

Result:

---

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Loading an website is not supported by teams. You need to add a tab and add the authentication to Application. Could you please check this docs and sample for more info?

Thanks,

Nikitha.

If the response is helpful, please click "Accept Answer" and upvote it. You can share your feedback via Microsoft Teams Developer Feedback link. Click here to escalate.