Slack令牌验证返回两个单独的签名

Question

我正在尝试使用Slack文档中提供的示例代码验证我的Slack机器人。然而，它返回了两个不同的签名。

def lambda_handler(event, context):
# get slack secret from secrets manager
secret = get_secret()
# needed for creating hmac
qstring = base64.b64decode(event['body']).decode('utf-8')
return validate_request(secret, qstring, event['headers'])
# get slack secret for verification from secrets manager
def get_secret():
secret_name = "<omitted>"
region_name = "<omitted>"
session = boto3.session.Session()
client = session.client(
service_name='secretsmanager',
region_name=region_name
)
try:
get_secret_value_response = client.get_secret_value(
SecretId=secret_name
)
except ClientError as e:
if e.response['Error']['Code'] == 'DecryptionFailureException':
raise e
elif e.response['Error']['Code'] == 'InternalServiceErrorException':
raise e
elif e.response['Error']['Code'] == 'InvalidParameterException':
raise e
elif e.response['Error']['Code'] == 'InvalidRequestException':
raise e
elif e.response['Error']['Code'] == 'ResourceNotFoundException':
raise e
else:
if 'SecretString' in get_secret_value_response:
return get_secret_value_response['SecretString']
else:
return base64.b64decode(get_secret_value_response['SecretBinary'])

# validate bot request
def validate_request(secret, body, headers):
timestamp = headers['x-slack-request-timestamp']
sig_basestring = 'v0:' + timestamp + ':' + body
my_signature = 'v0=' + hmac.new(secret.encode('utf_8'), sig_basestring.encode('utf_8'), hashlib.sha256).hexdigest()
slack_signature = headers['x-slack-signature']
if hmac.compare_digest(my_signature, slack_signature):
return True
else:
return False

结果：

v0=24dde133843073b58084970afe027e3a4dabc1b8d9efc5248a97ad64c6529cee
v0=bf51d6fb9eb56d5c6ea19e866b798903fb0cee67264cb467ee7924bb13571770

有什么想法吗？我已经验证了get_secret()返回了正确的令牌，并且qstring变量包含正确的查询参数，如Slack文档中所示。标头也都包含正确的值。

Answer 1

对我来说，签名是不同的，因为在传递给验证函数之前，我将从slack请求接收的正文格式化为json。

把尸体传过去解决了我的问题。

要传递以验证功能的正文格式-

'body'：'token=XXXXXXXXXX&team_id=XXXXXXX&team_domain=XXXXXX&channel_id＝XXXXX&channel_name=XXXXXX&user_id＝XXX&user_name=XXXX&命令=XXXXX&text=XXXX&api_app_id=XXXXXX&is_enterprise_install=false&response_url=XXXXX&trigger_id=XXXXXXXX'