Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Enhancement: Assistant should inherit global middleware for security and consistency

Ouverte
  • Quelque chose ne va pas ?
#1,346 2 commentaires 0 réactions 1 personne assignée Voir sur GitHub

@hello-ashleyintech y travaille déjà.

Depuis le 6/8/2025.

  • #1519 par @Cr1stal — ouverte

Évaluation

Cette issue n'a pas encore été évaluée.

Description

auto-triage-skip enhancement

Problem

Assistant handlers bypass global middleware entirely, creating a significant security gap and architectural inconsistency. Assistant events, assistant.user_message, assistant.thread_started etc. skip critical middleware that regular events receive, including:

  • SSL certificate verification
  • Request signature verification
  • Authorization middleware
  • URL verification
  • Custom middleware

This forces developers to manually implement security checks in each assistant handler, which is error-prone and violates the principle of secure-by-default design.

# These handlers get full middleware protection:
@app.event("app_mention")
async def handle_mention(event, say, context):
    # Already authenticated via middleware
    pass

# These handlers bypass ALL middleware (security vulnerability):

@assistant.user_message
async def handle_message(event, say, context):
    # No authentication, no SSL check, no signature verification!
    pass

Developer Experience: Developers must remember to add security manually to every assistant handler:

# Current: Manual security in every handler (error-prone)
@assistant.user_message(middleware=[auth_middleware, ssl_middleware])
async def handle_message(event, say, context):
    pass
Category
  • slack_bolt.App and/or its core components
  • slack_bolt.async_app.AsyncApp and/or its core components
  • Adapters in slack_bolt.adapter
  • Others
Requirements

Proposed Solution
Enhance Assistant/AsyncAssistant to automatically inherit the app's global middleware when handlers are registered. This would:

  1. Maintain backwards compatibility - existing explicit middleware still works
  2. Provide opt-in enhancement - controlled via auto_inherit_app_middleware=True parameter
  3. Apply middleware in correct order - app middleware first, then handler-specific middleware
Benefits
  1. Security by default - Assistant events get same protection as regular events
  2. Architectural consistency - All Slack events treated uniformly
  3. Developer productivity - No more manual security boilerplate
  4. Backwards compatible - Existing code continues working unchanged
  5. Performance neutral - Middleware already exists, just applied consistently
Langage dominant
Python
Étoiles
1.3k
Forks
291
Merge moyen
25 min
PR mergées (30 j)
2

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de slackapi/bolt-python

Toutes les issues de slackapi/bolt-python

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.