Slack X-Slack-Signature check

slack_signature_check

// X-Slack-Signature check (next to token check)
// added protection to slack token
// it calculates body hash to compare signature in slack header

const qs = require('querystring');
const crypto = require('crypto');

function SlackSginature( event, callback ) {
    const params = qs.parse( event.body );

    var hash = 'v0='+crypto.createHmac( 'sha256', secret ).update( 'v0:'+event.headers['X-Slack-Request-Timestamp']+':'+event.body ).digest( 'hex' );

    if( event.headers['X-Slack-Signature'] !== hash ) {
        console.error(`signature mismatch`);
        return callback('invalid body');
    }

    const user = params.user_name;
    const command = params.command;
    const channel = params.channel_name;
    const commandText = params.text;

    display( event.headers );
    display( params );
    console.log( event );
    console.log( 'slack signature: ' + event.headers['X-Slack-Signature'] );
    console.log( 'Calculated hash: ' + hash );
    callback( null, `${user} invoked ${command} in ${channel} with the following text: ${commandText}` );
}