Request Signing with Slack Signing Secret

[shishirsharma]

This is first cut.

Biggest caveat in the current approach is control of webserver. HMAC signature needs raw request body. So far the only way to do with express is via a middleware. That needs to be added before usual handleWebhookPayload.

PS: You will have to add the following snippet just after you create webserver in your code.

  var webserver = express();
  webserver.use(function(req, res, next) {
    req.rawBody = '';
    
    req.on('data', function(chunk) {
      req.rawBody += chunk;
    });
    
    next();
  });

[chrilian]

Hi there-- I tried this in my code and the req.rawBody comes out as empty? Is this just me? nothing gets passed into it in the stream basically...

[shishirsharma]

Yes, You will have to add the following snippet just after you create webserver in your code.

  var webserver = express();
  webserver.use(function(req, res, next) {
    req.rawBody = '';
    
    req.on('data', function(chunk) {
      req.rawBody += chunk;
    });
    
    next();
  });

[chrilian]

Thats what I did but for some reason my system must hate me....

[chrilian]

my bad-- I put it in the wrong place

[benbrown]

Can you please make these docs changes in the new official docs repo, github.com/howdyai/botkit-docs

[benbrown]

Can you make this same change to the slack starter kit? github.com/howdyai/botkit-starter-slack

[shishirsharma]

Sure