java-slack-sdk icon indicating copy to clipboard operation
java-slack-sdk copied to clipboard

Add documentation for using the `SlackSignature` verifier from `app_backend` with specific Java requirements

Open vigenere23 opened this issue 1 year ago • 2 comments

  1. There seems to be no documentation about how to verify requests using the Java SDK. The only documentation found is the general info.
  2. When trying to verify a Slack incoming request, we need to pass in the full URL-encoded body. However, the Java standard library does not URL-encode the aterix character *, thus resulting in an automatic failure if present in the payload. A notice or warning about how to correctly handle that would save some time.

The page URLs

No pages - to add in a new example or page.

Requirements

  1. Indicate that the app_backend module contains a helper to validate incoming Slack requests
  2. For Spring use, indicate that receiving a ContentCachingRequestWrapper allows for reading a raw request body, else it will be automatically deserialized.
  3. When calling the SlackSignature.Verifier method, indicate that the payload must be url-encoded, including for asterix, and that there may be a need to encode the * character manually (to %2A).

vigenere23 avatar Mar 06 '24 15:03 vigenere23

Hi @vigenere23, thanks for taking the time to share this feedback! This is why we recommend going with a simple WebServlet even in a Spring Boot app like this: https://slack.dev/java-slack-sdk/guides/supported-web-frameworks#spring-boot However, the document page does not clearly mention why the example is a simple servlet. We will update the page with clearer information soon. Thanks again for writing in!

seratch avatar Mar 07 '24 02:03 seratch

In the provided example, when and how is the request validated? I think that too could be shown too.

vigenere23 avatar Mar 16 '24 13:03 vigenere23