Securing FB Graph API Requests

[ouadie-lahdioui]

Hello,

Almost every Graph API call requires an access token. Malicious developers can steal access tokens and use them to send spam from your bot with malicious software on a person's computer or a man in the middle attack.

To prevent that, Facebook recommend sending an app secret proof parameter to every API call.

This PR add a new configuration attribute require_appsecret_proof to enable sending the sha256 proof each call Botkit makes.

var controller = Botkit.facebookbot({
    debug: true,
    log: true,
    access_token: process.env.page_token,
    verify_token: process.env.verify_token,
    app_secret: process.env.app_secret,
    require_appsecret_proof: true
});

Enjoy ✌️

[HassenIO]

Good job 💪 @ouadie-lahdioui,
I just have minor suggestions, all related to readability.
One more thing: Shouldn't be some tests there? At least for the new getAppSecretProof method, and in case the app secret is required but not provided by the bot.
Keep on the good work 👍

[HassenIO]

debug and log are mandatory options.

Just for clarity purpose, I suggest not mentioning them in your example and just show required options (like tokens + app_secret) + the new app secret proof.

[ouadie-lahdioui]

Done

[HassenIO]

I'm probably missing the big picture, but is this method intended to be used somewhere else?

If not, I suggest to use more explicit parameter names, like:

function getAppSecretProof(access_token, app_secret) {
    var hmac = crypto.createHmac('sha256', app_secret);
    return hmac.update(access_token).digest('hex');
}

[ouadie-lahdioui]

totally agree 👍

[ouadie-lahdioui]

Thanks @htaidirt for the review.

• Yes, it should be a lot of tests there, unfortunately not all functionalities are tested. fork the project and help adding some cool tests.
• In case the app secret is not provided Botkit will encrypt using an empty key.