Enhancement: Assistant should inherit global middleware for security and consistency
@hello-ashleyintech is already working on this.
Since Aug 6, 2025.
Assessment
This issue has not been assessed yet.
Description
Problem
Assistant handlers bypass global middleware entirely, creating a significant security gap and architectural inconsistency. Assistant events, assistant.user_message, assistant.thread_started etc. skip critical middleware that regular events receive, including:
- SSL certificate verification
- Request signature verification
- Authorization middleware
- URL verification
- Custom middleware
This forces developers to manually implement security checks in each assistant handler, which is error-prone and violates the principle of secure-by-default design.
# These handlers get full middleware protection:
@app.event("app_mention")
async def handle_mention(event, say, context):
# Already authenticated via middleware
pass
# These handlers bypass ALL middleware (security vulnerability):
@assistant.user_message
async def handle_message(event, say, context):
# No authentication, no SSL check, no signature verification!
pass
Developer Experience: Developers must remember to add security manually to every assistant handler:
# Current: Manual security in every handler (error-prone)
@assistant.user_message(middleware=[auth_middleware, ssl_middleware])
async def handle_message(event, say, context):
pass
Category
- slack_bolt.App and/or its core components
- slack_bolt.async_app.AsyncApp and/or its core components
- Adapters in slack_bolt.adapter
- Others
Requirements
Proposed Solution
Enhance Assistant/AsyncAssistant to automatically inherit the app's global middleware when handlers are registered. This would:
- Maintain backwards compatibility - existing explicit middleware still works
- Provide opt-in enhancement - controlled via auto_inherit_app_middleware=True parameter
- Apply middleware in correct order - app middleware first, then handler-specific middleware
Benefits
- Security by default - Assistant events get same protection as regular events
- Architectural consistency - All Slack events treated uniformly
- Developer productivity - No more manual security boilerplate
- Backwards compatible - Existing code continues working unchanged
- Performance neutral - Middleware already exists, just applied consistently
- Dominant language
- Python
- Stars
- 1.3k
- Forks
- 288
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 10
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from slackapi/bolt-python
-
docs enhancement server-side
Difficulty 1/5 Under an hour Newbie friendliness 88/100
slackapi/bolt-python#1576 · 1 comment ·
-
auto-triage-skip bug security semver:major
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
slackapi/bolt-python#1447 · 9 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 65/100
slackapi/bolt-python#1577 ·
-
area:async auto-triage-skip dependencies
Difficulty 3/5 1-2 days Newbie friendliness 65/100
slackapi/bolt-python#1472 · 1 comment · 1 reaction ·
-
auto-triage-skip discussion
Difficulty 4/5 3-5 days Newbie friendliness 45/100
slackapi/bolt-python#1332 · 2 comments · 1 reaction ·
All issues in slackapi/bolt-python
Similar issues
-
documentation help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
simonw/sqlite-utils#872 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100