Noizu.Slack.Signature (Noizu.Slack v0.1.0)

Copy Markdown View Source

Verifies Slack request signatures (Events API, slash commands, interactivity).

Slack sends X-Slack-Request-Timestamp and X-Slack-Signature (v0=<hex HMAC-SHA256(signing_secret, "v0:" <> timestamp <> ":" <> raw_body)>). Verify against the raw request body, before any JSON/form parsing.

:ok = Noizu.Slack.Signature.verify(secret, ts_header, raw_body, sig_header)

Requests older (or newer) than the replay window (default 300 s) are rejected. Comparison is constant-time.

Summary

Functions

sign(signing_secret, timestamp, body)

Computes the v0=<hex> signature for timestamp + body (useful in tests).

verify(signing_secret, timestamp, body, signature, opts \\ [])

Verifies a request. Returns :ok or {:error, %Error{tag: :signature, reason: r}} with r in :invalid_timestamp | :stale_timestamp | :invalid_signature.

Functions

sign(signing_secret, timestamp, body)

@spec sign(String.t(), String.t() | integer(), iodata()) :: String.t()

Computes the v0=<hex> signature for timestamp + body (useful in tests).

verify(signing_secret, timestamp, body, signature, opts \\ [])

@spec verify(
  String.t(),
  String.t() | integer(),
  iodata(),
  String.t() | nil,
  keyword()
) ::
  :ok | {:error, Noizu.Slack.Error.t()}

Verifies a request. Returns :ok or {:error, %Error{tag: :signature, reason: r}} with r in :invalid_timestamp | :stale_timestamp | :invalid_signature.

Options: :tolerance (seconds, default 300), :now (unix seconds; default System.os_time(:second)).