[Question] The error message and the conditional expression do not seem to match?
About
I think the condition of this code as written is the opposite.
if (signatureHash === hmac.hex()) {
throw new Error(`${verifyErrorPrefix}: signature mismatch`)
}
If I'm wrong about any part of this, I'd like to know about it 🙇
Detail
I'm currently using this Bolt library to create a Slack Bot. I have a question about this message that I sometimes receive during the development process.
[WARN] Request verification failed: Failed to verify authenticity: signature mismatch
When I checked where this error message was being output, I noticed that the conditional expression was the opposite.
https://github.com/khrj/slack-bolt/blob/52a8c52955e2a4dcca11e55717be4ab6ea4fd051/src/receivers/verify-request.ts#L85
I checked the relevant part of the library for Node.js and the flow described in the documentation, but it looked different from here.
- https://github.com/slackapi/node-slack-sdk/blob/2a9df19b29951931edee0c0e6f8435bbc1ffb501/packages/events-api/src/http-handler.ts#L53
- https://api.slack.com/authentication/verifying-requests-from-slack#verifying-requests-from-slack-using-signing-secrets__a-recipe-for-security__step-by-step-walk-through-for-validating-a-request
If this is intentional and caused by me missing something, please don't worry about it. If not, please respond and provide a new version. I would appreciate it if you could respond.
Thanks.