The Slack Signature Authentication module is a Python-based solution for Flask applications to be able to authenticate POST requests coming in from Slack. The module returns HTTP code 403 for those requests that fail Slack’s signature validation. The module adds a decorator that can be used for Flask routes.
Integrity
Added SLSA provenance checks to every release starting with v1.0.9
You will need to install slsa-verifier first
Provenance verification
python -m pip download --only-binary=:all: flask-slacksigauth #Downloads flask_slacksigauth-1.0.9-py3-none-any.whl
curl --location -O https://github.com/eaescob/flask-slacksigauth/releases/download/v1.0.9/multiple.intoto.jsonl
slsa-verifier verify-artifact \
--provenance-path multiple.intoto.jsonl \
--source-uri github.com/eaescob/flask-slacksigauth \
flask_slacksigauth-1.0.9-py3-none-any.whlCheck for - PASSED: Verified SLSA Provenance
After successful verification, package is safe to be installed.
Installation
pip install flask-slacksigauthApp Setup
After declaring your Flask API endpoints, you can decorate them to for authentication checks:
@app.route('/api', methods=['POST', 'GET'])
@slack_sig_auth
def api():
return jsonify(message='OK'), 200This will force slack signature authentication for you ‘/api’ endoint.
Release files for flask-slacksigauth 1.0.10
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| flask_slacksigauth-1.0.10.tar.gz | 15.9 kB | Without provenance | Details for flask_slacksigauth-1.0.10.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| flask_slacksigauth-1.0.10-py3-none-any.whl | Python 3 | none | any | Details for flask_slacksigauth-1.0.10-py3-none-any.whl |
Total release size: 31.4 kB
Release files / flask_slacksigauth-1.0.10.tar.gz
| Download URL | flask_slacksigauth-1.0.10.tar.gz |
|---|---|
| Size | 15.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
7504e40d76ffee44e19311e8f35e6097546aec44fc97e2275b5c8462e2e2f657
|
|
BLAKE2b-256 checksum How to use checksums |
cc007a9884324bd98ab7bc5e93e69a7983c28f317d22c8bd9f73580d23929554
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.1.0 CPython/3.12.4
|
Release files / flask_slacksigauth-1.0.10-py3-none-any.whl
| Download URL | flask_slacksigauth-1.0.10-py3-none-any.whl |
|---|---|
| Size | 15.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f24a384d8b4ce52453c0160c6f3958fb4c5b0db26d754b7b1a3f8b8cddec078e
|
|
BLAKE2b-256 checksum How to use checksums |
51e51edb34c9e48439781d07c5fb81313454c479d62e531abdbc220b745b6745
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/5.1.0 CPython/3.12.4
|
Security for flask-slacksigauth 1.0.10
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
