Verify that a Slack webhook request is authentic using HMAC-SHA256.
Performs two checks:
Timestamp freshness: Rejects requests older than 5 minutes to prevent replay attacks
Signature verification: Computes HMAC-SHA256 of v0:{timestamp}:{body} and compares
with the signature header using crypto.timingSafeEqual to prevent timing attacks
Parameters
req: Request
Express request object. Must have x-slack-request-timestamp and
x-slack-signature headers, and a parsed req.body.
signingSecret: string
Slack app signing secret from the app configuration page.
Returns boolean
true if the request is authentic, false otherwise.
Example
app.post('/webhook/slack', (req, res) => { if (!verifySlackSignature(req, process.env.SLACK_SIGNING_SECRET)) { returnres.status(401).send('Invalid signature'); } // Process the request... });
Verify that a Slack webhook request is authentic using HMAC-SHA256.
Performs two checks:
v0:{timestamp}:{body}and compares with the signature header usingcrypto.timingSafeEqualto prevent timing attacks