-
Notifications
You must be signed in to change notification settings - Fork 275
Closed
Labels
Milestone
Description
Having a state
parameter in OAuth flow is a highly recommended practice for security in general. However, when Slack org/workspace admins install an app from their app management page, there is no way to customize the authorize url.
Thus, to support the admins' use case, we can introduce a new option to disable state
parameter validation in the OAuth flow. We are going to add flag options to App
and AsyncApp
plus modify the internal logic.
oauth_settings.state_validation_enabled: bool
flag (default:True
)async_oauth_settings.state_validation_enabled: bool
flag (default:True
)
https://github.com/slackapi/bolt-python/tree/v1.8.1/slack_bolt/oauth
Category (place an x
in each of the [ ]
)
- slack_bolt.App and/or its core components
- slack_bolt.async_app.AsyncApp and/or its core components
- Adapters in slack_bolt.adapter
- Others
Requirements
Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you are agreeing to those rules.