Skip to content

Conversation

losandes
Copy link

@losandes losandes commented May 9, 2020

Summary

Updates the examples and documentation to implmenent RFC-6819 Section
5.3.5
: Link the "state" Parameter to User Agent Session. These examples demonstrate how to mitigate Cross Site Request Forgery (CSRF) by synchronizing all 3 parties (user, Slack, app) in the OAuth flow. Uses the synchronizer token pattern (STP) and a JWT embedded in a cookie to bind the token to the device.

NOTE: this is an alternate to #1013 that introduces no changes to the library; only to the examples

Requirements (place an x in each [ ])

Updates the examples and documentation to implmenent RFC-6819 Section
5.3.5: Link the "state" Parameter to User Agent Session.
@codecov
Copy link

codecov bot commented May 9, 2020

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 94.40%. Comparing base (88c3d86) to head (6a46ca0).
Report is 911 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1014   +/-   ##
=======================================
  Coverage   94.40%   94.40%           
=======================================
  Files          12       12           
  Lines         768      768           
  Branches      173      173           
=======================================
  Hits          725      725           
  Misses         14       14           
  Partials       29       29           
Flag Coverage Δ
eventsapi 89.61% <ø> (ø)
interactivemessages 95.04% <ø> (ø)
webapi 96.03% <ø> (ø)
webhook 87.50% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

@stevengill stevengill added the pkg:oauth applies to `@slack/oauth` label May 18, 2020
@clavin clavin changed the base branch from master to main July 8, 2020 02:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pkg:oauth applies to `@slack/oauth`

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants