java-slack-sdk
java-slack-sdk copied to clipboard
Add documentation for using the `SlackSignature` verifier from `app_backend` with specific Java requirements
- There seems to be no documentation about how to verify requests using the Java SDK. The only documentation found is the general info.
- When trying to verify a Slack incoming request, we need to pass in the full URL-encoded body. However, the Java standard library does not URL-encode the aterix character
*, thus resulting in an automatic failure if present in the payload. A notice or warning about how to correctly handle that would save some time.
The page URLs
No pages - to add in a new example or page.
Requirements
- Indicate that the
app_backendmodule contains a helper to validate incoming Slack requests - For Spring use, indicate that receiving a
ContentCachingRequestWrapperallows for reading a raw request body, else it will be automatically deserialized. - When calling the
SlackSignature.Verifiermethod, indicate that the payload must be url-encoded, including for asterix, and that there may be a need to encode the*character manually (to%2A).
Hi @vigenere23, thanks for taking the time to share this feedback! This is why we recommend going with a simple WebServlet even in a Spring Boot app like this: https://slack.dev/java-slack-sdk/guides/supported-web-frameworks#spring-boot However, the document page does not clearly mention why the example is a simple servlet. We will update the page with clearer information soon. Thanks again for writing in!
In the provided example, when and how is the request validated? I think that too could be shown too.