Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add documentation for using the SlackSignature verifier from app_backend with specific Java requirements #1290

Open
vigenere23 opened this issue Mar 6, 2024 · 2 comments
Labels
docs M-T: Documentation work only project:bolt
Milestone

Comments

@vigenere23
Copy link

  1. There seems to be no documentation about how to verify requests using the Java SDK. The only documentation found is the general info.
  2. When trying to verify a Slack incoming request, we need to pass in the full URL-encoded body. However, the Java standard library does not URL-encode the aterix character *, thus resulting in an automatic failure if present in the payload. A notice or warning about how to correctly handle that would save some time.

The page URLs

No pages - to add in a new example or page.

Requirements

  1. Indicate that the app_backend module contains a helper to validate incoming Slack requests
  2. For Spring use, indicate that receiving a ContentCachingRequestWrapper allows for reading a raw request body, else it will be automatically deserialized.
  3. When calling the SlackSignature.Verifier method, indicate that the payload must be url-encoded, including for asterix, and that there may be a need to encode the * character manually (to %2A).
@seratch seratch added project:bolt docs M-T: Documentation work only and removed untriaged labels Mar 7, 2024
@seratch seratch added this to the 1.x milestone Mar 7, 2024
@seratch
Copy link
Member

seratch commented Mar 7, 2024

Hi @vigenere23, thanks for taking the time to share this feedback! This is why we recommend going with a simple WebServlet even in a Spring Boot app like this: https://slack.dev/java-slack-sdk/guides/supported-web-frameworks#spring-boot However, the document page does not clearly mention why the example is a simple servlet. We will update the page with clearer information soon. Thanks again for writing in!

@vigenere23
Copy link
Author

In the provided example, when and how is the request validated? I think that too could be shown too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docs M-T: Documentation work only project:bolt
Projects
None yet
Development

No branches or pull requests

2 participants