Slack · sdk · fg-0366

Slack signature check always fails because the framework already parsed the body

Invalid request signature on every request from Slack

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

The HMAC is computed over v0:timestamp:raw body, so a body that was parsed and serialized again no longer matches byte for byte. Requests whose X-Slack-Request-Timestamp is more than five minutes from local time must be rejected.

Fix

Capture the raw body before any parser runs, compare with a constant-time function, and keep the server clock in sync with NTP.

Apply

app.use("/slack/events", express.raw({ type: "*/*" }));
const base = `v0:${ts}:${req.body.toString("utf8")}`;
const sig = "v0=" + crypto.createHmac("sha256", secret).update(base).digest("hex");
crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(req.get("x-slack-signature")));

Affects: Slack HTTP request verification with signing secret v0, all versions as of 2026-10

Sources

• https://docs.slack.dev/authentication/verifying-requests-from-slack/

claude mcp add --transport http footgun https://getfootgun.com/api/mcp