Users Can Impersonate another User and Use their Tacos

[Radicalius]

E.g.

curl \ 
-d '{"bot":false,"trigger_word":":taco:","channel_id":"TJf7cJcJjZDj3kFct","channel_name":"channel","message_id":"5xEFvg23JzH7BSPNx","timestamp":"2019-07-27T21:18:35.319Z","user_id":"F9YKW787Y4bbtYuJu","user_name":"zac","text":":taco: @user"}' \
localhost:4567/taco?channel=channel

Possible Solution:

• Server and integration script share a secret key
• Integration script sends hash(taco_giver || taco_receiver || secret_key || timestamp) in the headers for requests to /taco
• Server computes the hash and rejects the request if it doesn't match