Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Enhancement: Assistant should inherit global middleware for security and consistency

Abierto
#1,346 2 comentarios 0 reacciones 1 asignado Ver en GitHub

@hello-ashleyintech ya está trabajando en esto.

Desde el 6/8/2025.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

auto-triage-skip enhancement

Problem

Assistant handlers bypass global middleware entirely, creating a significant security gap and architectural inconsistency. Assistant events, assistant.user_message, assistant.thread_started etc. skip critical middleware that regular events receive, including:

  • SSL certificate verification
  • Request signature verification
  • Authorization middleware
  • URL verification
  • Custom middleware

This forces developers to manually implement security checks in each assistant handler, which is error-prone and violates the principle of secure-by-default design.

# These handlers get full middleware protection:
@app.event("app_mention")
async def handle_mention(event, say, context):
    # Already authenticated via middleware
    pass

# These handlers bypass ALL middleware (security vulnerability):

@assistant.user_message
async def handle_message(event, say, context):
    # No authentication, no SSL check, no signature verification!
    pass

Developer Experience: Developers must remember to add security manually to every assistant handler:

# Current: Manual security in every handler (error-prone)
@assistant.user_message(middleware=[auth_middleware, ssl_middleware])
async def handle_message(event, say, context):
    pass
Category
  • slack_bolt.App and/or its core components
  • slack_bolt.async_app.AsyncApp and/or its core components
  • Adapters in slack_bolt.adapter
  • Others
Requirements

Proposed Solution
Enhance Assistant/AsyncAssistant to automatically inherit the app's global middleware when handlers are registered. This would:

  1. Maintain backwards compatibility - existing explicit middleware still works
  2. Provide opt-in enhancement - controlled via auto_inherit_app_middleware=True parameter
  3. Apply middleware in correct order - app middleware first, then handler-specific middleware
Benefits
  1. Security by default - Assistant events get same protection as regular events
  2. Architectural consistency - All Slack events treated uniformly
  3. Developer productivity - No more manual security boilerplate
  4. Backwards compatible - Existing code continues working unchanged
  5. Performance neutral - Middleware already exists, just applied consistently
Lenguaje dominante
Python
Estrellas
1.3k
Forks
288
Merge medio
1 d 8 h
PR fusionados (30 d)
10

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de slackapi/bolt-python

Todos los issues de slackapi/bolt-python

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.