How to Test Slack Webhooks

{
  "type": "event_callback",
  "event": {
    "type": "message",
    "channel": "C0123456789",
    "user": "U0123456789",
    "text": "Hello from Slack!",
    "ts": "1710000000.000000"
  },
  "team_id": "T0123456789"
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post(
  '/webhooks/slack',
  express.raw({ type: 'application/x-www-form-urlencoded' }),
  (req, res) => {
    const timestamp = req.headers['x-slack-request-timestamp'] as string;
    const signature = req.headers['x-slack-signature'] as string;

    // Reject requests older than 5 minutes (replay protection).
    const fiveMinutes = 60 * 5;
    if (Math.abs(Math.floor(Date.now() / 1000) - parseInt(timestamp, 10)) > fiveMinutes) {
      return res.status(401).send('stale request');
    }

    const baseString = `v0:${timestamp}:${req.body.toString('utf8')}`;
    const expected =
      'v0=' +
      crypto
        .createHmac('sha256', process.env.SLACK_SIGNING_SECRET!)
        .update(baseString)
        .digest('hex');

    if (
      signature.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
    ) {
      return res.status(401).send('invalid signature');
    }

    res.json({ ok: true });
  },
);

import hmac, hashlib, os, time
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.post("/webhooks/slack")
async def slack_webhook(request: Request):
    body = await request.body()
    timestamp = request.headers.get('x-slack-request-timestamp', '0')
    signature = request.headers.get('x-slack-signature', '')

    if abs(int(time.time()) - int(timestamp)) > 60 * 5:
        raise HTTPException(status_code=401, detail='stale request')

    base_string = f"v0:{timestamp}:{body.decode('utf-8')}".encode()
    expected = 'v0=' + hmac.new(
        os.environ['SLACK_SIGNING_SECRET'].encode(),
        msg=base_string,
        digestmod=hashlib.sha256,
    ).hexdigest()
    if not hmac.compare_digest(signature, expected):
        raise HTTPException(status_code=401, detail='invalid signature')
    return {'ok': True}