{"action":"created","issue":{"url":"https://api.github.com/repos/howdyai/botkit/issues/167","repository_url":"https://api.github.com/repos/howdyai/botkit","labels_url":"https://api.github.com/repos/howdyai/botkit/issues/167/labels{/name}","comments_url":"https://api.github.com/repos/howdyai/botkit/issues/167/comments","events_url":"https://api.github.com/repos/howdyai/botkit/issues/167/events","html_url":"https://github.com/howdyai/botkit/pull/167","id":144755914,"number":167,"title":"Adds authentication of incoming Slack requests","user":{"login":"sgud","id":8689269,"avatar_url":"https://avatars.githubusercontent.com/u/8689269?v=3","gravatar_id":"","url":"https://api.github.com/users/sgud","html_url":"https://github.com/sgud","followers_url":"https://api.github.com/users/sgud/followers","following_url":"https://api.github.com/users/sgud/following{/other_user}","gists_url":"https://api.github.com/users/sgud/gists{/gist_id}","starred_url":"https://api.github.com/users/sgud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sgud/subscriptions","organizations_url":"https://api.github.com/users/sgud/orgs","repos_url":"https://api.github.com/users/sgud/repos","events_url":"https://api.github.com/users/sgud/events{/privacy}","received_events_url":"https://api.github.com/users/sgud/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-03-31T00:31:27Z","updated_at":"2016-03-31T02:17:59Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/howdyai/botkit/pulls/167","html_url":"https://github.com/howdyai/botkit/pull/167","diff_url":"https://github.com/howdyai/botkit/pull/167.diff","patch_url":"https://github.com/howdyai/botkit/pull/167.patch"},"body":"Adds optional support for authenticating requests from\r\nSlack slash commands.  Validates that the request body\r\nincludes a known token."},"comment":{"url":"https://api.github.com/repos/howdyai/botkit/issues/comments/203718916","html_url":"https://github.com/howdyai/botkit/pull/167#issuecomment-203718916","issue_url":"https://api.github.com/repos/howdyai/botkit/issues/167","id":203718916,"user":{"login":"sgud","id":8689269,"avatar_url":"https://avatars.githubusercontent.com/u/8689269?v=3","gravatar_id":"","url":"https://api.github.com/users/sgud","html_url":"https://github.com/sgud","followers_url":"https://api.github.com/users/sgud/followers","following_url":"https://api.github.com/users/sgud/following{/other_user}","gists_url":"https://api.github.com/users/sgud/gists{/gist_id}","starred_url":"https://api.github.com/users/sgud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sgud/subscriptions","organizations_url":"https://api.github.com/users/sgud/orgs","repos_url":"https://api.github.com/users/sgud/repos","events_url":"https://api.github.com/users/sgud/events{/privacy}","received_events_url":"https://api.github.com/users/sgud/received_events","type":"User","site_admin":false},"created_at":"2016-03-31T02:17:59Z","updated_at":"2016-03-31T02:17:59Z","body":"This can certainly be activated by default. I think it makes sense to activate it by default as you can ensure that all endpoints are only ever reached if the token is valid, thus securing the server more effectively. This is in contrast to the current security mechanism which involves validating the api token in the slash command event itself. \r\n\r\nIn order to activate by default, the secureWebhookEndpoints() function needs only to be added as the first line of createWebhookEndpoints() and the parameters of createWebhookEndpoints() modified to include authentication tokens."}}