Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

web-api: prevent apps.event.authorizations.list API from ever sending token in the body #1737

Merged
merged 2 commits into from
Jan 29, 2024

Conversation

filmaj
Copy link
Contributor

@filmaj filmaj commented Jan 26, 2024

Sending token in the body for the apps.event.authorizations.list API will cause the API to return an error (see the last sentence in this doc).

This fixes #1498.

Additionally, this PR compiles all headers when logging them out in debug mode - even the ones axios sets by default. This critically also includes the token if the token is passed in to WebClient constructor. I made this change and included it here as otherwise determining the full list of headers sent by web-api was challenging. Optionally, this logging feature can be removed if people have opinions about it. Previously, the debug output would look like this:

[DEBUG]  web-api:WebClient:0 apiCall('apps.event.authorizations.list') start
[DEBUG]  web-api:WebClient:0 http request url: https://slack.com/api/apps.event.authorizations.list
[DEBUG]  web-api:WebClient:0 http request body: {"event_context":"4-eyJldCI6Im1lc3NhZ2UiLCJ0aWQiOiJUMDI5VjY0NjhSTCIsImFpZCI6IkEwNjAxUkVRTDkzIiwiY2lkIjoiQzAyOVlUNUtFTUIifQ"}
[DEBUG]  web-api:WebClient:0 http request headers: {}

Note the request headers are stated to be empty (when passing a token into the WebClient constructor). Impossible, as the token needs to be provided SOMEHOW!

With the logging changes introduced in this PR, the same call as above now yields:

[DEBUG]  web-api:WebClient:0 apiCall('apps.event.authorizations.list') start
[DEBUG]  web-api:WebClient:0 http request url: https://slack.com/api/apps.event.authorizations.list
[DEBUG]  web-api:WebClient:0 http request body: {"event_context":"4-eyJldCI6Im1lc3NhZ2UiLCJ0aWQiOiJUMDI5VjY0NjhSTCIsImFpZCI6IkEwNjAxUkVRTDkzIiwiY2lkIjoiQzAyOVlUNUtFTUIifQ"}
[DEBUG]  web-api:WebClient:0 http request headers: {"User-Agent":"@slack:web-api/7.0.1 node/18.15.0 darwin/23.2.0","Authorization":"[[REDACTED]]","Accept":"application/json, text/plain, */*"}

… token in the body (as this results in an API error). additionally, compile all headers when logging them out in debug mode - even the ones axios sets by default. this critically also includes the token if the token is passed in to WebClient constructor.
@filmaj filmaj added semver:patch pkg:web-api applies to `@slack/web-api` labels Jan 26, 2024
@filmaj filmaj added this to the [email protected] milestone Jan 26, 2024
@filmaj filmaj requested review from seratch and a team January 26, 2024 20:54
@filmaj filmaj self-assigned this Jan 26, 2024
Copy link
Member

@seratch seratch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for fixing this!

packages/web-api/src/WebClient.ts Show resolved Hide resolved
@filmaj filmaj merged commit 664db4e into main Jan 29, 2024
17 checks passed
@filmaj filmaj deleted the web-api-auth-list-fix branch January 29, 2024 18:40
renovate bot referenced this pull request in adobe/spacecat-shared Feb 17, 2024
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
|
[@aws-sdk/client-dynamodb](https://togithub.com/aws/aws-sdk-js-v3/tree/main/clients/client-dynamodb)
([source](https://togithub.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb))
| [`3.511.0` ->
`3.515.0`](https://renovatebot.com/diffs/npm/@aws-sdk%2fclient-dynamodb/3.511.0/3.515.0)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/@aws-sdk%2fclient-dynamodb/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@aws-sdk%2fclient-dynamodb/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@aws-sdk%2fclient-dynamodb/3.511.0/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@aws-sdk%2fclient-dynamodb/3.511.0/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
|
[@aws-sdk/client-s3](https://togithub.com/aws/aws-sdk-js-v3/tree/main/clients/client-s3)
([source](https://togithub.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3))
| [`3.511.0` ->
`3.515.0`](https://renovatebot.com/diffs/npm/@aws-sdk%2fclient-s3/3.511.0/3.515.0)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/@aws-sdk%2fclient-s3/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@aws-sdk%2fclient-s3/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@aws-sdk%2fclient-s3/3.511.0/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@aws-sdk%2fclient-s3/3.511.0/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
|
[@aws-sdk/client-sqs](https://togithub.com/aws/aws-sdk-js-v3/tree/main/clients/client-sqs)
([source](https://togithub.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs))
| [`3.511.0` ->
`3.515.0`](https://renovatebot.com/diffs/npm/@aws-sdk%2fclient-sqs/3.511.0/3.515.0)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/@aws-sdk%2fclient-sqs/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@aws-sdk%2fclient-sqs/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@aws-sdk%2fclient-sqs/3.511.0/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@aws-sdk%2fclient-sqs/3.511.0/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
|
[@aws-sdk/lib-dynamodb](https://togithub.com/aws/aws-sdk-js-v3/tree/main/lib/lib-dynamodb)
([source](https://togithub.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb))
| [`3.511.0` ->
`3.515.0`](https://renovatebot.com/diffs/npm/@aws-sdk%2flib-dynamodb/3.511.0/3.515.0)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/@aws-sdk%2flib-dynamodb/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@aws-sdk%2flib-dynamodb/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@aws-sdk%2flib-dynamodb/3.511.0/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@aws-sdk%2flib-dynamodb/3.511.0/3.515.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
| [@slack/web-api](https://slack.dev/node-slack-sdk/web-api)
([source](https://togithub.com/slackapi/node-slack-sdk)) | [`7.0.1` ->
`7.0.2`](https://renovatebot.com/diffs/npm/@slack%2fweb-api/7.0.1/7.0.2)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/@slack%2fweb-api/7.0.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/@slack%2fweb-api/7.0.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/@slack%2fweb-api/7.0.1/7.0.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@slack%2fweb-api/7.0.1/7.0.2?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
| [husky](https://togithub.com/typicode/husky) | [`9.0.6` ->
`9.0.11`](https://renovatebot.com/diffs/npm/husky/9.0.10/9.0.11) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/husky/9.0.11?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/husky/9.0.11?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/husky/9.0.10/9.0.11?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/husky/9.0.10/9.0.11?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
| [husky](https://togithub.com/typicode/husky) | [`9.0.10` ->
`9.0.11`](https://renovatebot.com/diffs/npm/husky/9.0.10/9.0.11) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/husky/9.0.11?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/husky/9.0.11?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/husky/9.0.10/9.0.11?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/husky/9.0.10/9.0.11?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>aws/aws-sdk-js-v3 (@&#8203;aws-sdk/client-dynamodb)</summary>

###
[`v3.515.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-dynamodb/CHANGELOG.md#35150-2024-02-15)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.514.0...v3.515.0)

**Note:** Version bump only for package
[@&#8203;aws-sdk/client-dynamodb](https://togithub.com/aws-sdk/client-dynamodb)

###
[`v3.514.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-dynamodb/CHANGELOG.md#35140-2024-02-14)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.513.0...v3.514.0)

**Note:** Version bump only for package
[@&#8203;aws-sdk/client-dynamodb](https://togithub.com/aws-sdk/client-dynamodb)

###
[`v3.513.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-dynamodb/CHANGELOG.md#35130-2024-02-13)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.511.0...v3.513.0)

##### Features

- **experimentalIdentityAndAuth:** release phase for services without
customizations
([#&#8203;5787](https://togithub.com/aws/aws-sdk-js-v3/issues/5787))
([4004ff6](https://togithub.com/aws/aws-sdk-js-v3/commit/4004ff68a8ad20f6e60e8fab1f8952928f92f4b7))

</details>

<details>
<summary>aws/aws-sdk-js-v3 (@&#8203;aws-sdk/client-s3)</summary>

###
[`v3.515.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-s3/CHANGELOG.md#35150-2024-02-15)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.514.0...v3.515.0)

**Note:** Version bump only for package
[@&#8203;aws-sdk/client-s3](https://togithub.com/aws-sdk/client-s3)

###
[`v3.514.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-s3/CHANGELOG.md#35140-2024-02-14)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.513.0...v3.514.0)

**Note:** Version bump only for package
[@&#8203;aws-sdk/client-s3](https://togithub.com/aws-sdk/client-s3)

###
[`v3.513.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-s3/CHANGELOG.md#35130-2024-02-13)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.511.0...v3.513.0)

##### Features

- **experimentalIdentityAndAuth:** release phase for services without
customizations
([#&#8203;5787](https://togithub.com/aws/aws-sdk-js-v3/issues/5787))
([4004ff6](https://togithub.com/aws/aws-sdk-js-v3/commit/4004ff68a8ad20f6e60e8fab1f8952928f92f4b7))

</details>

<details>
<summary>aws/aws-sdk-js-v3 (@&#8203;aws-sdk/client-sqs)</summary>

###
[`v3.515.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-sqs/CHANGELOG.md#35150-2024-02-15)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.514.0...v3.515.0)

**Note:** Version bump only for package
[@&#8203;aws-sdk/client-sqs](https://togithub.com/aws-sdk/client-sqs)

###
[`v3.514.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-sqs/CHANGELOG.md#35140-2024-02-14)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.513.0...v3.514.0)

**Note:** Version bump only for package
[@&#8203;aws-sdk/client-sqs](https://togithub.com/aws-sdk/client-sqs)

###
[`v3.513.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-sqs/CHANGELOG.md#35130-2024-02-13)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.511.0...v3.513.0)

##### Features

- **experimentalIdentityAndAuth:** release phase for services without
customizations
([#&#8203;5787](https://togithub.com/aws/aws-sdk-js-v3/issues/5787))
([4004ff6](https://togithub.com/aws/aws-sdk-js-v3/commit/4004ff68a8ad20f6e60e8fab1f8952928f92f4b7))

</details>

<details>
<summary>aws/aws-sdk-js-v3 (@&#8203;aws-sdk/lib-dynamodb)</summary>

###
[`v3.515.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/lib/lib-dynamodb/CHANGELOG.md#35150-2024-02-15)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.514.0...v3.515.0)

**Note:** Version bump only for package
[@&#8203;aws-sdk/lib-dynamodb](https://togithub.com/aws-sdk/lib-dynamodb)

###
[`v3.514.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/lib/lib-dynamodb/CHANGELOG.md#35140-2024-02-14)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.513.0...v3.514.0)

**Note:** Version bump only for package
[@&#8203;aws-sdk/lib-dynamodb](https://togithub.com/aws-sdk/lib-dynamodb)

###
[`v3.513.0`](https://togithub.com/aws/aws-sdk-js-v3/blob/HEAD/lib/lib-dynamodb/CHANGELOG.md#35130-2024-02-13)

[Compare
Source](https://togithub.com/aws/aws-sdk-js-v3/compare/v3.511.0...v3.513.0)

**Note:** Version bump only for package
[@&#8203;aws-sdk/lib-dynamodb](https://togithub.com/aws-sdk/lib-dynamodb)

</details>

<details>
<summary>slackapi/node-slack-sdk (@&#8203;slack/web-api)</summary>

###
[`v7.0.2`](https://togithub.com/slackapi/node-slack-sdk/releases/tag/%40slack/web-api%407.0.2)

[Compare
Source](https://togithub.com/slackapi/node-slack-sdk/compare/@slack/[email protected]...@slack/[email protected])

#### What's Changed

Nothing major or even minor in this release! Just a few patches:

- web-api: prevent apps.event.authorizations.list API from ever sending
token in the body by [@&#8203;filmaj](https://togithub.com/filmaj) in
[https://github.com/slackapi/node-slack-sdk/pull/1737](https://togithub.com/slackapi/node-slack-sdk/pull/1737)
- web-api(fix): include file or contents types in file_uploads arguments
by [@&#8203;zimeg](https://togithub.com/zimeg) in
[https://github.com/slackapi/node-slack-sdk/pull/1744](https://togithub.com/slackapi/node-slack-sdk/pull/1744)
- web-api(fix): share tokens provided as arguments in files upload to
upload jobs by [@&#8203;zimeg](https://togithub.com/zimeg) in
[https://github.com/slackapi/node-slack-sdk/pull/1745](https://togithub.com/slackapi/node-slack-sdk/pull/1745)
- web-api(chore): release
[@&#8203;slack/web-api](https://togithub.com/slack/web-api)[@&#8203;7](https://togithub.com/7).0.2
by [@&#8203;zimeg](https://togithub.com/zimeg) in
[https://github.com/slackapi/node-slack-sdk/pull/1746](https://togithub.com/slackapi/node-slack-sdk/pull/1746)

**Full Changelog**:
https://github.com/slackapi/node-slack-sdk/compare/[@&#8203;slack/cli-hooks](https://togithub.com/slack/cli-hooks)[@&#8203;1](https://togithub.com/1).0.0...[@&#8203;slack/web-api](https://togithub.com/slack/web-api)[@&#8203;7](https://togithub.com/7).0.2

</details>

<details>
<summary>typicode/husky (husky)</summary>

###
[`v9.0.11`](https://togithub.com/typicode/husky/releases/tag/v9.0.11)

[Compare
Source](https://togithub.com/typicode/husky/compare/v9.0.10...v9.0.11)

- chore: update package-lock.json by
[@&#8203;btea](https://togithub.com/btea) in
[https://github.com/typicode/husky/pull/1383](https://togithub.com/typicode/husky/pull/1383)
- fix: husky=0 in init (fixes
[#&#8203;1393](https://togithub.com/typicode/husky/issues/1393)) by
[@&#8203;typicode](https://togithub.com/typicode) in
[https://github.com/typicode/husky/pull/1395](https://togithub.com/typicode/husky/pull/1395)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "after 2pm on Saturday" in timezone
Europe/Zurich, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/adobe/spacecat-shared).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xOTEuMCIsInVwZGF0ZWRJblZlciI6IjM3LjE5MS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pkg:web-api applies to `@slack/web-api` semver:patch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

token parameter in apps.event.authorizations.list method call results in invalid_auth error
2 participants