diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1eeed24492..c5500063fb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -186,7 +186,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
### Samples
-- Fixes [#3632](https://github.com/microsoft/BotFramework-WebChat/issues/3632). Update reaction button sample: Add `replyToId` to the `postActivity` object, by [@amal-khalaf](https://github.com/amal-khalaf) in PR [#3769](https://github.com/microsoft/BotFramework-WebChat/pull/3769)
+- Fixes [#3632](https://github.com/microsoft/BotFramework-WebChat/issues/3632). Update reaction button sample : Add replyToId to the postActivity object, by [@amal-khalaf](https://github.com/amal-khalaf) in PR [#3769](https://github.com/microsoft/BotFramework-WebChat/pull/3769)
+- Fixes [#2343](https://github.com/microsoft/BotFramework-WebChat/issues/2343). Add sample for Direct Line tokens, by [@navzam](https://github.com/navzam), in PR [#3779](https://github.com/microsoft/BotFramework-WebChat/pull/3779)
## [4.12.0] - 2021-03-01
diff --git a/samples/01.getting-started/k.direct-line-token/README.md b/samples/01.getting-started/k.direct-line-token/README.md
new file mode 100644
index 0000000000..03f14dbda8
--- /dev/null
+++ b/samples/01.getting-started/k.direct-line-token/README.md
@@ -0,0 +1,341 @@
+# Direct Line Token Sample
+
+# Description
+
+This sample demonstrates how to integrate Web Chat in a way that 1) does not expose your Direct Line secret to the browser, and 2) mitigates user impersonation by not allowing the client to set its own user ID.
+
+See the [Motivation](#Motivation) section below for more background on these issues.
+
+# Test out the hosted sample
+
+There is no hosted demo for this sample yet.
+
+# How to run locally
+
+This demo includes a bot that you will run locally, so before running the code, you will have to set up an Azure Bot Service resource.
+
+1. [Clone the code](#clone-the-code)
+1. [Setup Azure Bot Services](#setup-azure-bot-services)
+1. [Prepare and run the code](#prepare-and-run-the-code)
+
+## Clone the code
+
+To host this demo, you will need to clone the code and run locally.
+
+Clone the JavaScript project
+
+1. Clone this repository
+1. Create two empty files for environment variables, `/bot/.env` and `/web/.env`
+
+Clone the C# project
+
+1. Clone this repository
+1. Open the two `appsettings.json` files at `/bot/appsettings.json` and `/web/appsettings.json`
+
+JavaScript
+
+1. Save the Microsoft App ID and password to `/bot/.env`
+ - `MICROSOFT_APP_ID=12345678-1234-5678-abcd-12345678abcd`
+ - `MICROSOFT_APP_PASSWORD=a1b2c3d4e5f6`
+1. Save the Web Chat secret to `/web/.env`
+ - `DIRECT_LINE_SECRET=a1b2c3.d4e5f6g7h8i9j0`
+
+C#
+
+1. Save the Microsoft App ID and password to `/bot/appsettings.json`
+ - `"MicrosoftAppId": "12345678-1234-5678-abcd-12345678abcd"`
+ - `"MicrosoftAppPassword": "a1b2c3d4e5f6"`
+1. Save the Web Chat secret to `/web/appsettings.json`
+ - `"DirectLineSecret": "a1b2c3.d4e5f6g7h8i9j0"`
+
+JavaScript
+
+ 1. `npm install`
+ 1. `npm start`
+
+ C#
+
+ 1. `dotnet build`
+ 1. `dotnet run`
+
+ JavaScript
+
+```js
+// web/src/routes/directLine/token.js
+
+async function generateRandomUserId() {
+ const buffer = await randomBytesAsync(16);
+ return `dl_${buffer.toString('hex')}`;
+}
+```
+
+C#
+
+```csharp
+// web/Controllers/DirectLineController.cs
+
+private static string GenerateRandomUserId()
+{
+ byte[] tokenData = new byte[16];
+ using var rng = new RNGCryptoServiceProvider();
+ rng.GetBytes(tokenData);
+
+ return $"dl_{BitConverter.ToString(tokenData).Replace("-", "").ToLower()}";
+}
+```
+
+JavaScript
+
+```js
+// web/src/generateDirectLineToken.js
+
+async function generateDirectLineToken(secret, userId) {
+ const { token } = await fetchJSON('https://directline.botframework.com/v3/directline/tokens/generate', {
+ headers: {
+ authorization: `Bearer ${secret}`,
+ 'Content-Type': 'application/json'
+ },
+ method: 'POST',
+ body: JSON.stringify({
+ user: {
+ id: userId
+ }
+ })
+ });
+
+ return token;
+};
+```
+
+C#
+
+```csharp
+// web/Services/DirectLineService.cs
+
+httpClient.BaseAddress = new Uri("https://directline.botframework.com/");
+
+...
+
+public async Task GetTokenAsync(string directLineSecret, string userId, CancellationToken cancellationToken = default)
+{
+ var tokenRequestBody = new { user = new { id = userId } };
+ var tokenRequest = new HttpRequestMessage(HttpMethod.Post, "v3/directline/tokens/generate")
+ {
+ Headers =
+ {
+ { "Authorization", $"Bearer {directLineSecret}" },
+ },
+ Content = new StringContent(JsonSerializer.Serialize(tokenRequestBody), Encoding.UTF8, MediaTypeNames.Application.Json),
+ };
+
+ var tokenResponseMessage = await _httpClient.SendAsync(tokenRequest, cancellationToken);
+
+ ...
+
+ using var responseContentStream = await tokenResponseMessage.Content.ReadAsStreamAsync();
+ var tokenResponse = await JsonSerializer.DeserializeAsync(responseContentStream);
+
+ return new DirectLineTokenDetails
+ {
+ Token = tokenResponse.Token,
+ ConversationId = tokenResponse.ConversationId,
+ ExpiresIn = tokenResponse.ExpiresIn,
+ };
+}
+```
+
+JavaScript
+
+### `/bot/.env`
+
+```
+MICROSOFT_APP_ID=12345678-1234-5678-abcd-12345678abcd
+MICROSOFT_APP_PASSWORD=a1b2c3d4e5f6
+```
+
+### `/web/.env`
+
+```
+DIRECT_LINE_SECRET=a1b2c3.d4e5f6g7h8i9j0
+```
+
+C#
+
+### `/bot/appsettings.json`
+
+```json
+{
+ "Logging": {
+ "LogLevel": {
+ "Default": "Information",
+ "Microsoft": "Warning",
+ "Microsoft.Hosting.Lifetime": "Information"
+ }
+ },
+ "AllowedHosts": "*",
+ "MicrosoftAppId": "12345678-1234-5678-abcd-12345678abcd",
+ "MicrosoftAppPassword": "a1b2c3d4e5f6"
+}
+```
+
+### `/web/appsettings.json`
+
+```json
+{
+ "Logging": {
+ "LogLevel": {
+ "Default": "Information",
+ "Microsoft": "Warning",
+ "Microsoft.Hosting.Lifetime": "Information"
+ }
+ },
+ "AllowedHosts": "*",
+ "DirectLineSecret": "a1b2c3.d4e5f6g7h8i9j0"
+}
+```
+
+