Files
openclaw/extensions
Xavier Coulon fbc12e0879 fix(slack): stop leaking bot token into /api/auth.test request body (#94574)
* fix(slack): stop leaking bot token into /api/auth.test request body

The bot token is already passed as an `Authorization` header,
so we don't need to send it in the request body when calling `/api/auth.test`.

See [Slack API documentation](https://api.slack.com/methods/auth.test).

Also, showing with `curl` that the bot token is not needed in the request body when passed as an `Authorization` header when calling `/api/auth.test`:
```
curl -X POST https://slack.com:443/api/auth.test -H "Authorization: Bearer xoxb-..."
{"ok":true,"url":"https://xcoulonworkspace.slack.com/","team":"xcoulon",...}
```

Signed-off-by: Xavier Coulon <xcoulon@redhat.com>

* add test for slack auth.test token handling

verify that the bot token is not passed in the request body when calling `/api/auth.test`.

Signed-off-by: Xavier Coulon <xcoulon@redhat.com>

---------

Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
2026-06-18 18:09:37 -04:00
..
2026-06-17 07:25:30 +08:00
2026-06-17 07:25:30 +08:00
2026-06-19 01:20:06 +08:00
2026-06-17 07:25:30 +08:00