Function verifySlackSignature

server/src/slack/verify.ts:23–55

(
  signingSecret: string,
  requestSignature: string,
  requestTimestamp: string,
  body: string
)

 * @returns true if signature is valid
 */
export function verifySlackSignature(
  signingSecret: string,
  requestSignature: string,
  requestTimestamp: string,
  body: string
): boolean {
  // Check timestamp is recent (within 5 minutes)
  const timestamp = parseInt(requestTimestamp, 10);
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > 60 * 5) {
    logger.warn({ timestamp, now, diff: Math.abs(now - timestamp) }, 'Slack request timestamp too old');
    return false;
  }

  // Create signature base string
  const sigBasestring = `v0:${requestTimestamp}:${body}`;

  // Create HMAC signature
  const mySignature = 'v0=' + crypto
    .createHmac('sha256', signingSecret)
    .update(sigBasestring)
    .digest('hex');

  // Compare signatures using timing-safe comparison
  try {
    return crypto.timingSafeEqual(
      Buffer.from(mySignature, 'utf8'),
      Buffer.from(requestSignature, 'utf8')
    );
  } catch {
    return false;
  }
}

/**
 * Express middleware to verify Slack request signatures