Allow PHP application access only for slack

Question

I have implemented slack -Jenkins Integration;

Triggering Jenkins build with parameters job by using PHP application hosted in a server.

Slash command to call PHP application ;

PHP application will take the input by REQUEST method and then call the Jenkins job .

If any one knows the file name(www.myserver.com/filename.php) and cracked the run time arguments(paramters), then they can do the deployments . By calling the it in the URL.

Slack doesn't have static IP . So IP restriction is not possible .

Tried : RewriteCond %{REQUEST_METHOD} !^POST$ RewriteRule ^/check.php$ - [NC,R=404,L] in the .htaccess. But Fails the testcase.

Simply , need to allow the PHP application only from slack

ceejayoz ceejayoz · Accepted Answer · 2018-01-08T15:56:26

You'll want to process the verification token that comes with every slack request.

Verification tokens

Slash commands, Events API deliveries, and interactive messages all have one thing in common:

Slack dispatches a request that lands on your server. You need a way to identify that it really came from Slack. So every Slack app has a verification token that acts as a shared secret between your app and Slack. This verification token has nothing to do with any other kind of token on Slack. It's never needed for any API operations your app sends to Slack. It's only use case is to securely identify traffic coming from Slack.

Don't confuse verification tokens with an OAuth token, user token (xoxp), bot user token (xoxb), gossip girl token (xoxo), or workspace token (xoxa). The only relation is that token word "token."

Allow PHP application access only for slack

1 Answers