slackapi / slackapi/node-slack-sdk
oauth: Add timeout for state verification
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 3.4k
- Forks
- 688
- Avg merge
- 15h 31m
- Merged PRs (30d)
- 27
Description
Description
Let's add a timeout check in verifyStateParam to not allow stale states to be verified. Probably a 30 second timeout.
Question: Is this something that the developer should be able to override? Other than just providing their own stateStore implementation?
What type of issue is this? (place an x in one of the [ ])
- enhancement (feature request)
Requirements (place an x in each of the [ ])
- I've read and understood the Contributing guidelines and have done my best effort to follow them.
- I've read and agree to the Code of Conduct.
- I've searched for any related issues and avoided creating a duplicate issue.
Packages:
Select all that apply:
- `@slack/oauth
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating verifyStateParam in the @slack/oauth package and tracing how its stateStore supplies state data. Determine how the proposed 30-second timeout should interact with stateStore implementations and whether developers can override it. Done means stale states are rejected and the override behavior is documented and covered by the relevant tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100