search

larrabee / freeipa-password-reset

Self-service password reset app for FreeIPA
GNU General Public License v3.0
88 stars 30 forks source link

Slack Conversations API #40

Open kbetsis opened 4 years ago

kbetsis commented 4 years ago

Awesome work and really nice options available through the provider list. Everything works with no problems at all.

One comment, which i see making huge difference, security wise.

The SLACK Webhook provider requires the existence of a slack channel. As you can understand posting a token for a user reset to a channel is like asking for someone to test which user was it through simple brute force.

A better approach would be through the use of Slack's conversation API (https://api.slack.com/methods/conversations.open) which offers the capability to direct message the password request token to the user.

larrabee commented 4 years ago

Hello.
Unfortunately we do not use Slack and this functionality is not written by me. If you use Slack and can make the PR with changes, it will be cool.