GrafeasGroup / blossom

The website. The app. The everything.
6 stars 3 forks source link

add slack verification #224

Closed itsthejoker closed 2 years ago

itsthejoker commented 2 years ago

Relevant issue: N/a

Description:

Need to actually verify that requests coming in on the slack endpoint actually come from slack. This is a security hole and also since I'm about to implement a command that modifies data, we need to be extra sure. The actual process for verifying is a pain in the butt, but I think that this is accurate.

Checklist:

itsthejoker commented 2 years ago

Update: this does appear to actually work

itsthejoker commented 2 years ago

The replay prevention is straight from Slack's documentation, so it's something we can add a test for but beyond that I'm taking their word.