diff --git a/libraries/botframework-connector/src/auth/jwtTokenValidation.ts b/libraries/botframework-connector/src/auth/jwtTokenValidation.ts index 98604d7671..faced238ee 100644 --- a/libraries/botframework-connector/src/auth/jwtTokenValidation.ts +++ b/libraries/botframework-connector/src/auth/jwtTokenValidation.ts @@ -132,6 +132,9 @@ export namespace JwtTokenValidation { if (authConfig.validateClaims) { // Call the validation method if defined (it should throw an exception if the validation fails) await authConfig.validateClaims(claims); + } else if (SkillValidation.isSkillClaim(claims)) { + // Skill claims must be validated using AuthenticationConfiguration validateClaims + throw new AuthenticationError('Unauthorized Access. Request is not authorized. Skill Claims require validation.', StatusCodes.UNAUTHORIZED); } }