Requests made to the `/events` endpoint are not verified

Open

wasimxyzopened 1y ago

Unless I'm missing something, it appears that the await verifyRequest call made in this line of api/events.ts doesn't do anything.

The verifyRequest function returns a Response object, but the actual route handler itself doesn't return it. This means that the route handler will continue processing invalid / unverified requests.

In api/events.ts:

export async function POST(request: Request) {
  const rawBody = await request.text();
  const payload = JSON.parse(rawBody);
  const requestType = payload.type as "url_verification" | "event_callback";

  // See https://api.slack.com/events/url_verification.
  if (requestType === "url_verification") {
    return new Response(payload.challenge, { status: 200 });
  }

  await verifyRequest({ requestType, request, rawBody });
  ...

In lib/slack-utils:

export const verifyRequest = async ({
	requestType,
	request,
	rawBody,
}: {
	requestType: string;
	request: Request;
	rawBody: string;
}) => {
	const validRequest = await isValidSlackRequest({ request, rawBody });
	if (!validRequest || requestType !== "event_callback") {
		return new Response("Invalid request", { status: 400 });
	}
};

Should be an easy fix. Just need to move the body of verifyRequest into the route handler. Happy to open a PR if I'm not mistaken.

Activity

No activity yet.