class SlackMsgr::Authenticate

Handles various authentication patterns offered by Slack

Public Class Methods

signing_secret?(request) click to toggle source
# File lib/slack_msgr/authenticate.rb, line 11
def signing_secret?(request)
  signature = request.headers['X-Slack-Signature']
  timestamp = request.headers['X-Slack-Request-Timestamp']
  version   = signature.split('=').first
  body      = request.body.read

  # The request timestamp is more than five minutes from local time.
  # It could be a replay attack, so let's ignore it.
  return false if timestamp_over_five_minutes_old?(timestamp)

  signature == "#{version}=#{compute_hash_sha256(version, timestamp, body)}"
end
verification_token?(token) click to toggle source
# File lib/slack_msgr/authenticate.rb, line 7
def verification_token?(token)
  token == SlackMsgr.configuration.verification_token
end

Private Class Methods

compute_hash_sha256(version, timestamp, body) click to toggle source
# File lib/slack_msgr/authenticate.rb, line 26
def compute_hash_sha256(version, timestamp, body)
  digest = OpenSSL::Digest::SHA256.new
  OpenSSL::HMAC.hexdigest(digest, SlackMsgr.configuration.signing_secret, "#{version}:#{timestamp}:#{body}")
end
timestamp_over_five_minutes_old?(timestamp) click to toggle source
# File lib/slack_msgr/authenticate.rb, line 31
def timestamp_over_five_minutes_old?(timestamp)
  (Time.now - Time.at(timestamp.to_i)) > (60 * 5)
end