Millipede Academy

Book 3 · Lesson 3.8

Slack webhook security

  • Verify Slack signing secret before parsing body
  • Reject tampered X-Slack-Signature
  • Explain replay protection with timestamp

Prerequisites: 3.2

Slack (and similar vendors) prove webhook authenticity with HMAC-SHA256:

v0 = HMAC-SHA256(signing_secret, "v0:" + timestamp + ":" + raw_body)

SlackSignatureVerifier — compute signature, then tamper to see rejection.

Ingestion checklist

  1. Read raw body bytes (before JSON parse)
  2. Compare X-Slack-Signature constant-time
  3. Reject if timestamp skew > 5 minutes

Teach-back prompt

Why parse JSON only after signature verification?

Slack signature verify

Lesson 3.8 check

1. Slack webhooks should verify…