This sample shows how to secure your conversation including the use of a Direct Line token instead of secret, for user id, generate it inside client side and detect if the client has changed the user ID and reject the change.
Open this sample in the gallery (popup panel): Open in gallery
Source: https://github.com/pnp/sp-dev-fx-webparts/tree/main/samples/react-bot-framework-secure