Slack (major) add webhook payload verification

src/appmixer/slack/bundle.json

@@ -1,6 +1,6 @@
 {
     "name": "appmixer.slack",
-    "version": "3.2.0",
+    "version": "4.0.0",
     "engine": ">=6.0.0",
     "changelog": {
         "1.0.1": [
@@ -29,6 +29,9 @@
         ],
         "3.2.0": [
             "NewChannelMessageRT: added more output variables such as: channel, channel_type, team, event_ts, blocks, bot_profile."
+        ],
+        "4.0.0": [
+            "(breaking change) Added payload authentication for triggers. Will require setting `signingSecret` in the connector configuration."
         ]
     }
 }

src/appmixer/slack/list/NewChannelMessageRT/NewChannelMessageRT.js

@@ -4,8 +4,14 @@ module.exports = {
 
     async start(context) {
 
+        const componentName = context.flowDescriptor[context.componentId].label || 'New Channel Message';
+
         if (!context.config?.authToken) {
-            throw new Error('Missing Slack configuration. Please configure the `authToken` with a valid Slack App token.');
+            throw new Error(`Missing Slack configuration for component: ${componentName}. Please configure the "authToken" with a valid Slack App token.`);
+        }
+
+        if (!context.config.signingSecret) {
+            throw new Error(`Missing Slack configuration for component: ${componentName}. Please configure the "signingSecret" with a valid Slack App signing secret.`);
         }
 
         return context.addListener(context.properties.channelId, { accessToken: context.auth.accessToken } );

src/appmixer/slack/list/NewUserWebhook/NewUserWebhook.js

@@ -4,6 +4,12 @@ module.exports = {
 
     async start(context) {
 
+        const componentName = context.flowDescriptor[context.componentId].label || 'New User';
+
+        if (!context.config.signingSecret) {
+            throw new Error(`Missing Slack configuration for component: ${componentName}. Please configure the "signingSecret" with a valid Slack App signing secret.`);
+        }
+
         return context.addListener('slack_team_join', { accessToken: context.auth.accessToken });
     },
 

src/appmixer/slack/routes.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { createHmac } = require('node:crypto');
+
 module.exports = async context => {
 
     context.onListenerAdded(async listener => {
@@ -34,11 +36,29 @@ module.exports = async context => {
         path: '/events',
         options: {
             auth: false,
-            handler: async req => {
+            handler: async (req, h) => {
 
                 await context.log('info', 'slack-plugin-route-webhook-hit', { type: req.payload?.type });
                 context.log('trace', 'slack-plugin-route-webhook-payload', { payload: req.payload });
 
+                // Validates the payload with the Slack-signature hash
+                const slackSignature = req.headers['x-slack-signature'];
+                const signingSecret = context.config?.signingSecret;
+                if (!signingSecret) {
+                    context.log('error', 'slack-plugin-route-webhook-missing-signingSecret');
+                    return h.response(undefined).code(401);
+                }
+                // Use the raw request body from `req.payload`, without headers, before it has been deserialized from JSON or other forms.
+                const payloadString = JSON.stringify(req.payload);
+                const timestamp = req.headers['x-slack-request-timestamp'];
+                const baseString = `v0:${timestamp}:${payloadString}`;
+                const mySignature = 'v0=' + createHmac('sha256', signingSecret).update(baseString).digest('hex');
+                if (slackSignature !== mySignature) {
+                    context.log('info', 'slack-plugin-route-webhook-invalid-signature', { config: context.config });
+                    context.log('error', 'slack-plugin-route-webhook-invalid-signature', { slackSignature, mySignature, baseString, payloadString });
+                    return h.response(undefined).code(401);
+                }
+
                 if (req.payload.challenge) {
                     return { challenge: req.payload.challenge };
                 }