Slack Webhooks

const crypto = require('crypto');

app.post('/webhooks/slack', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.headers['x-slack-request-timestamp'];
  const slackSig = req.headers['x-slack-signature'];
  // Prevent replay attacks
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) {
    return res.status(400).send('Request too old');
  }
  const sigBase = `v0:${timestamp}:${req.body}`;
  const hmac = crypto.createHmac('sha256', process.env.SLACK_SIGNING_SECRET);
  const digest = 'v0=' + hmac.update(sigBase).digest('hex');
  if (!crypto.timingSafeEqual(Buffer.from(digest), Buffer.from(slackSig))) {
    return res.status(403).send('Invalid signature');
  }
  const body = JSON.parse(req.body);
  if (body.type === 'url_verification') return res.json({ challenge: body.challenge });
  // Handle body.event here
  res.sendStatus(200);
});

import hmac, hashlib, time, os
from flask import Flask, request

app = Flask(__name__)

@app.route('/webhooks/slack', methods=['POST'])
def slack_webhook():
    timestamp = request.headers.get('X-Slack-Request-Timestamp', '')
    if abs(time.time() - int(timestamp)) > 300:
        return 'Request too old', 400
    sig_base = f"v0:{timestamp}:{request.get_data().decode()}"
    digest = 'v0=' + hmac.new(
        os.environ['SLACK_SIGNING_SECRET'].encode(),
        sig_base.encode(), hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(digest, request.headers.get('X-Slack-Signature', '')):
        return 'Invalid signature', 403
    body = request.get_json()
    if body.get('type') == 'url_verification':
        return {'challenge': body['challenge']}
    # Handle body['event'] here
    return '', 200