slackline/verify

Verify that an HTTP request really came from Slack.

Slack signs every request it sends to your app with your app’s signing secret (found under Basic Information in your app’s settings). Check the signature before trusting the body. See https://docs.slack.dev/authentication/verifying-requests-from-slack.

case verify.request(request, signing_secret) {
  Ok(Nil) -> handle(request)
  Error(_) -> response.new(401)
}

Types

VerifyError

</>

Why a request failed verification.

pub type VerifyError {
  MissingTimestamp
  MissingSignature
  StaleTimestamp(timestamp: Int, now: Int)
  InvalidSignature
}

Constructors

```
MissingTimestamp
```
The x-slack-request-timestamp header is missing or not a number.
```
MissingSignature
```
The x-slack-signature header is missing.
```
StaleTimestamp(timestamp: Int, now: Int)
```
The timestamp is more than max_age_seconds away from now.
```
InvalidSignature
```
The signature does not match the body.

Values

check

</>

pub fn check(
  signing_secret signing_secret: String,
  timestamp timestamp: Int,
  signature signature: String,
  body body: String,
  now now: Int,
) -> Result(Nil, VerifyError)

Verifies the raw pieces of a signed request.

max_age_seconds

</>

pub const max_age_seconds: Int

How far a request timestamp may drift from the current time, in seconds, before check rejects it as a replay. Slack recommends five minutes.

now_seconds

</>

pub fn now_seconds() -> Int

The current unix time in seconds.

request

</>

pub fn request(
  request: request.Request(String),
  signing_secret: String,
) -> Result(Nil, VerifyError)

Verifies a request against the current time.

request_at

</>

pub fn request_at(
  request: request.Request(String),
  signing_secret: String,
  now: Int,
) -> Result(Nil, VerifyError)

Verifies a request against an explicit time (unix seconds). Useful for tests and replayed traffic.

sign

</>

pub fn sign(
  signing_secret: String,
  timestamp: Int,
  body: String,
) -> String

The x-slack-signature value Slack would send for a body. Use it to sign requests in tests.