Enhancement: Assistant should inherit global middleware for security and consistency
@hello-ashleyintech ya está trabajando en esto.
Desde el 6/8/2025.
Evaluación
Este issue todavía no se ha evaluado.
Descripción
Problem
Assistant handlers bypass global middleware entirely, creating a significant security gap and architectural inconsistency. Assistant events, assistant.user_message, assistant.thread_started etc. skip critical middleware that regular events receive, including:
- SSL certificate verification
- Request signature verification
- Authorization middleware
- URL verification
- Custom middleware
This forces developers to manually implement security checks in each assistant handler, which is error-prone and violates the principle of secure-by-default design.
# These handlers get full middleware protection:
@app.event("app_mention")
async def handle_mention(event, say, context):
# Already authenticated via middleware
pass
# These handlers bypass ALL middleware (security vulnerability):
@assistant.user_message
async def handle_message(event, say, context):
# No authentication, no SSL check, no signature verification!
pass
Developer Experience: Developers must remember to add security manually to every assistant handler:
# Current: Manual security in every handler (error-prone)
@assistant.user_message(middleware=[auth_middleware, ssl_middleware])
async def handle_message(event, say, context):
pass
Category
- slack_bolt.App and/or its core components
- slack_bolt.async_app.AsyncApp and/or its core components
- Adapters in slack_bolt.adapter
- Others
Requirements
Proposed Solution
Enhance Assistant/AsyncAssistant to automatically inherit the app's global middleware when handlers are registered. This would:
- Maintain backwards compatibility - existing explicit middleware still works
- Provide opt-in enhancement - controlled via auto_inherit_app_middleware=True parameter
- Apply middleware in correct order - app middleware first, then handler-specific middleware
Benefits
- Security by default - Assistant events get same protection as regular events
- Architectural consistency - All Slack events treated uniformly
- Developer productivity - No more manual security boilerplate
- Backwards compatible - Existing code continues working unchanged
- Performance neutral - Middleware already exists, just applied consistently
- Lenguaje dominante
- Python
- Estrellas
- 1.3k
- Forks
- 288
- Merge medio
- 1 d 8 h
- PR fusionados (30 d)
- 10
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de slackapi/bolt-python
-
docs enhancement server-side
Dificultad 1/5 Menos de una hora Aptitud para principiantes 88/100
slackapi/bolt-python#1576 · 1 comentario ·
-
auto-triage-skip bug security semver:major
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
slackapi/bolt-python#1447 · 9 comentarios ·
-
Dificultad 3/5 1-2 días Aptitud para principiantes 65/100
slackapi/bolt-python#1577 ·
-
area:async auto-triage-skip dependencies
Dificultad 3/5 1-2 días Aptitud para principiantes 65/100
slackapi/bolt-python#1472 · 1 comentario · 1 reacción ·
-
auto-triage-skip discussion
Dificultad 4/5 3-5 días Aptitud para principiantes 45/100
slackapi/bolt-python#1332 · 2 comentarios · 1 reacción ·
Todos los issues de slackapi/bolt-python
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
anthropics/skills#1811 · 1 comentario ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
speaches-ai/speaches#678 ·
-
bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
datalayer/mcp-compose#42 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 75/100
conda-forge/spacy-feedstock#177 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 70/100
UKGovernmentBEIS/inspect_evals#2523 ·