Skip to content

Add oauth_settings.state_validation_enabled to customize the OAuth flow #454

@seratch

Description

@seratch

Having a state parameter in OAuth flow is a highly recommended practice for security in general. However, when Slack org/workspace admins install an app from their app management page, there is no way to customize the authorize url.

Thus, to support the admins' use case, we can introduce a new option to disable state parameter validation in the OAuth flow. We are going to add flag options to App and AsyncApp plus modify the internal logic.

  • oauth_settings.state_validation_enabled: bool flag (default: True)
  • async_oauth_settings.state_validation_enabled: bool flag (default: True)

https://github.com/slackapi/bolt-python/tree/v1.8.1/slack_bolt/oauth

Category (place an x in each of the [ ])

  • slack_bolt.App and/or its core components
  • slack_bolt.async_app.AsyncApp and/or its core components
  • Adapters in slack_bolt.adapter
  • Others

Requirements

Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you are agreeing to those rules.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions