From fbc12e0879f746c7fd128165a1fca85407dca455 Mon Sep 17 00:00:00 2001 From: Xavier Coulon Date: Fri, 19 Jun 2026 00:09:37 +0200 Subject: [PATCH] fix(slack): stop leaking bot token into /api/auth.test request body (#94574) * fix(slack): stop leaking bot token into /api/auth.test request body The bot token is already passed as an `Authorization` header, so we don't need to send it in the request body when calling `/api/auth.test`. See [Slack API documentation](https://api.slack.com/methods/auth.test). Also, showing with `curl` that the bot token is not needed in the request body when passed as an `Authorization` header when calling `/api/auth.test`: ``` curl -X POST https://slack.com:443/api/auth.test -H "Authorization: Bearer xoxb-..." {"ok":true,"url":"https://xcoulonworkspace.slack.com/","team":"xcoulon",...} ``` Signed-off-by: Xavier Coulon * add test for slack auth.test token handling verify that the bot token is not passed in the request body when calling `/api/auth.test`. Signed-off-by: Xavier Coulon --------- Signed-off-by: Xavier Coulon --- .../monitor/provider.auth-test-token.test.ts | 31 +++++++++++++++++++ extensions/slack/src/monitor/provider.ts | 2 +- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 extensions/slack/src/monitor/provider.auth-test-token.test.ts diff --git a/extensions/slack/src/monitor/provider.auth-test-token.test.ts b/extensions/slack/src/monitor/provider.auth-test-token.test.ts new file mode 100644 index 000000000000..84697286e5af --- /dev/null +++ b/extensions/slack/src/monitor/provider.auth-test-token.test.ts @@ -0,0 +1,31 @@ +// Slack tests cover auth.test token handling during provider boot. +import { beforeEach, describe, expect, it } from "vitest"; +import { + getSlackClient, + resetSlackTestState, + startSlackMonitor, + stopSlackMonitor, +} from "../monitor.test-helpers.js"; + +const { monitorSlackProvider } = await import("./provider.js"); + +beforeEach(() => { + resetSlackTestState(); +}); + +describe("auth.test boot call", () => { + it("does not pass the bot token in the call arguments", async () => { + const monitor = startSlackMonitor(monitorSlackProvider); + await stopSlackMonitor(monitor); + + const client = getSlackClient(); + expect(client.auth.test).toHaveBeenCalledTimes(1); + // The SDK serializes every property from the call argument into the POST + // body. Passing { token } would leak the bot token into the request + // payload alongside the Authorization header. + const firstArg = client.auth.test.mock.calls[0]?.[0] as Record | undefined; + if (firstArg != null) { + expect(firstArg).not.toHaveProperty("token"); + } + }); +}); diff --git a/extensions/slack/src/monitor/provider.ts b/extensions/slack/src/monitor/provider.ts index f3feb4d8fa40..8f6b76f6fa85 100644 --- a/extensions/slack/src/monitor/provider.ts +++ b/extensions/slack/src/monitor/provider.ts @@ -296,7 +296,7 @@ export async function monitorSlackProvider(opts: MonitorSlackOpts = {}) { let authTestFailed = false; let authTestError: string | undefined; try { - const auth = await app.client.auth.test({ token: botToken }); + const auth = await app.client.auth.test(); botUserId = auth.user_id ?? ""; botId = (auth as { bot_id?: string }).bot_id ?? ""; teamId = auth.team_id ?? "";