Adds authentication of incoming Slack requests #167
Conversation
sgud
changed the title
|
Good idea! Thanks for the PR. Should this be on by default perhaps? What would that involve? |
|
This can certainly be activated by default. I think it makes sense to activate it by default as you can ensure that all endpoints are only ever reached if the token is valid, thus securing the server more effectively. This is in contrast to the current security mechanism which involves validating the api token in the slash command event itself (i.e. the endpoint is hit and validation is taking place subsequently). However, the downside is that making this a default option could impact backwards compatibility (may need to discuss further). In order to activate by default, the secureWebhookEndpoints() function needs only to be added as the first line of createWebhookEndpoints() and the parameters of createWebhookEndpoints() modified to include authentication tokens. |
|
I've modified the PR such that webhook authentication is now a default feature when creating webhook endpoints. Furthermore, by leaving the secureWebhookEndpoints() function as optional, this shouldn't impact backwards compatibility. |
| */ | ||
|
|
||
| // the list of authorized tokens that can invoke slash comamnds | ||
| const TOKEN_NOT_FOUND = -1; |
There was a problem hiding this comment.
Can you replace const with var please? We're trying to support NodeJS 0.12.x also.
There was a problem hiding this comment.
Done, I've replaced const with var and fixed the comment in line 7.
|
What a nice PR! Congrats. |
|
FYI if you want to test drive this PR. I did an npm pack build locally of this PR after rebasing from upstream/master (commit 940c3e0). Usage: |
|
I'll merge this in ASAP! |
|
@benbrown congrats! I'm a proud dad of 3 these days... The days are long, the years are short. Enjoy them! |
|
@benbrown Congratulations on the baby, wish you the best! |
|
This is fabulous! I couldn't do a direct merge of this PR, but all of this code and these new features are now included! |
Adds optional support for authenticating requests from
Slack slash commands. Validates that the request body
includes a known token.