/
verify.go
74 lines (60 loc) · 2.11 KB
/
verify.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
package verifyslack
import (
"bytes"
"crypto/hmac"
"crypto/sha256"
"encoding/hex"
"fmt"
"io/ioutil"
"net/http"
"strconv"
"time"
)
const MaxPermittedRequestAge time.Duration = 100 * time.Second
type timeGetter interface {
Now() time.Time
}
func RequestHandler(handler http.HandlerFunc, timeGetter timeGetter, signingSecret string) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
var timestamp string
if timestamp = r.Header.Get("X-Slack-Request-Timestamp"); timestamp == "" {
http.Error(w, "request did not contain a request timestamp", http.StatusBadRequest)
return
}
intTimestamp, err := strconv.ParseInt(timestamp, 10, 64)
if err != nil {
http.Error(w, "failed to parse request timestamp", http.StatusInternalServerError)
return
}
timeNow := timeGetter.Now()
if timeNow.After(time.Unix(intTimestamp, 0).Add(MaxPermittedRequestAge)) {
http.Error(w, "request is too old to be handled", http.StatusBadRequest)
return
}
var slackSignature string
if slackSignature = r.Header.Get("X-Slack-Signature"); slackSignature == "" {
http.Error(w, "request does not provide a Slack-signed signature", http.StatusUnauthorized)
return
}
requestBody, err := ioutil.ReadAll(r.Body)
if err != nil {
http.Error(w, "failed to read body", http.StatusInternalServerError)
return
}
// Restore the request body so the wrapped HTTP handler can read it again
r.Body = ioutil.NopCloser(bytes.NewBuffer(requestBody))
expectedSignature := GenerateExpectedSignature(timestamp, requestBody, signingSecret)
if !hmac.Equal([]byte(expectedSignature), []byte(slackSignature)) {
http.Error(w, "request is not signed with a valid Slack signature", http.StatusUnauthorized)
return
}
handler(w, r)
}
}
func GenerateExpectedSignature(timestamp string, requestBody []byte, signingSecret string) string {
baseSignature := append([]byte(fmt.Sprintf("v0:%s:", timestamp)), requestBody...)
mac := hmac.New(sha256.New, []byte(signingSecret))
mac.Write(baseSignature)
expectedSignature := fmt.Sprintf("v0=%s", hex.EncodeToString(mac.Sum(nil)))
return expectedSignature
}