token parameter in apps.event.authorizations.list method call results in invalid_auth error

[seratch]

If you pass an app-level token to WebClient's apps.event.authorizations.list method call, it results in invalid_auth error code. A workaround is to pass the token to WebClient constructor instead.

This fails with invalid_auth error:

const client = new WebClient();
const result = await web.apps.event.authorizations.list({
  token: 'xapp-xxx',
  event_context: 'xxx'
});

This following works:

const client = new WebClient(token);
const result = await web.apps.event.authorizations.list({
  event_context: 'xxx'
});

This behavior should be improved.

Packages:

Select all that apply:

• @slack/web-api
• @slack/rtm-api
• @slack/webhooks
• @slack/oauth
• @slack/socket-mode
• I don't know

Reproducible in:

The Slack SDK version

any

Node.js runtime version

any

OS info

any

[filmaj]

@seratch do you think this is still an issue? The token-overriding logic in web-api is so simple, I don't see how this is possible.

[seratch]

@filmaj I just checked the behavior again and it seems that it's still an issue. Not sure why this could happen only (perhaps only) for this endpoint.

[filmaj]

Yes very weird I can reproduce this. Looking into it.

[filmaj]

It seems like web-api sends the token both in the body and as a header (just based on the debug output):

[DEBUG]  web-api:WebClient:0 initialized
[DEBUG]  web-api:WebClient:0 apiCall('apps.event.authorizations.list') start
[DEBUG]  web-api:WebClient:0 http request url: https://slack.com/api/apps.event.authorizations.list
[DEBUG]  web-api:WebClient:0 http request body: {"token":"[[REDACTED]]","event_context":"4-eyJldCI6Im1lc3NhZ2UiLCJ0aWQiOiJUMDI5VjY0NjhSTCIsImFpZCI6IkEwNjAxUkVRTDkzIiwiY2lkIjoiQzAyOVlUNUtFTUIifQ"}
[DEBUG]  web-api:WebClient:0 http request headers: {"Authorization":"[[REDACTED]]"}

I wonder if the backend responds with an error due to this note in this section of this method's docs:

For this method, you will need to pass this token in the HTTP Authorization header of your request; passing it as a POST parameter will result in an error.