Secure Slack Webhook: Auto-Verify Incoming Request Signatures

How it works

This workflow is designed to enhance the security of your Slack webhook integrations by automatically verifying the signature of incoming requests. When a Slack webhook sends data to your n8n instance, this workflow intercepts it and performs a cryptographic check to confirm that the request genuinely originated from Slack.

It begins with the Execute Workflow Trigger node, which passes the incoming request data. The Make Slack Verif Token node (a Code node) processes the request's headers and body to construct the base string required for signature verification. This base string, along with the received x-slack-signature header, is then passed to the Encode Secret String node (Crypto node). This node uses your Slack Signing Secret (which you'll need to configure) to generate a candidate signature using the HMAC-SHA256 algorithm.

The IF node compares the generated candidate signature with the one provided in the x-slack-signature header. If they match (after prepending v0 to the generated signature as per Slack's protocol), the workflow proceeds to the Set Verified to True node, marking the signature as verified. If they do not match, the Stop and Error node is triggered, indicating a potential security breach or misconfiguration.

Finally, the Merge node combines the original request data with the verification status, providing a clear output indicating whether the Slack request was successfully authenticated.