class SlackMsgr::Authenticate
Handles various authentication patterns offered by Slack
Public Class Methods
signing_secret?(request)
click to toggle source
# File lib/slack_msgr/authenticate.rb, line 11 def signing_secret?(request) signature = request.headers['X-Slack-Signature'] timestamp = request.headers['X-Slack-Request-Timestamp'] version = signature.split('=').first body = request.body.read # The request timestamp is more than five minutes from local time. # It could be a replay attack, so let's ignore it. return false if timestamp_over_five_minutes_old?(timestamp) signature == "#{version}=#{compute_hash_sha256(version, timestamp, body)}" end
verification_token?(token)
click to toggle source
# File lib/slack_msgr/authenticate.rb, line 7 def verification_token?(token) token == SlackMsgr.configuration.verification_token end
Private Class Methods
compute_hash_sha256(version, timestamp, body)
click to toggle source
# File lib/slack_msgr/authenticate.rb, line 26 def compute_hash_sha256(version, timestamp, body) digest = OpenSSL::Digest::SHA256.new OpenSSL::HMAC.hexdigest(digest, SlackMsgr.configuration.signing_secret, "#{version}:#{timestamp}:#{body}") end
timestamp_over_five_minutes_old?(timestamp)
click to toggle source
# File lib/slack_msgr/authenticate.rb, line 31 def timestamp_over_five_minutes_old?(timestamp) (Time.now - Time.at(timestamp.to_i)) > (60 * 5) end