Where to find stateSecret value

Description

Hi everyone 👋 First off, love Bolt - great job!

I’m following along with implementing oAuth for Bolt using the docs and have implemented the following - my issue is I can’t find how to get the correct value for stateSecret?

How do you get this value to complete the oAuth flow so you’re able to authenticate and distribute your app?

const app = new App({
  signingSecret: process.env.SLACK_SIGNING_SECRET,
  clientId: process.env.SLACK_CLIENT_ID,
  clientSecret: process.env.SLACK_CLIENT_SECRET,
  stateSecret: 'my-state-secret', // where to find this value?
  scopes: ['channels:read', 'groups:read', 'channels:manage', 'chat:write', 'incoming-webhook'],
  installationStore: {
    storeInstallation: async (installation) => {
      // change the line below so it saves to your database
      return await database.set(installation.team.id, installation);
    },
    fetchInstallation: async (InstallQuery) => {
      // change the line below so it fetches from your database
      return await database.get(InstallQuery.teamId);
    },
  },
});

Sorry if this is obvious, I’ve tried searching the docs and feel I’m missing something right in my face.

If I understand correctly, once the user is redirected via http://api.mydomain.com/slack/oauth_redirect - this include the stateSecret? But how would I pass that value before the app is initalised? I’m not sure what I’m missing.

What type of issue is this? (place an x in one of the [ ])

• bug
• enhancement (feature request)
• question
• documentation related
• example code related
• testing related
• discussion

Requirements (place an x in each of the [ ])

• I’ve read and understood the Contributing guidelines and have done my best effort to follow them.
• I’ve read and agree to the Code of Conduct.
• I’ve searched for any related issues and avoided creating a duplicate issue.

[stevengill]

Hey @alexjackhughes!

Glad to hear you are loving bolt!

stateSecret is something you come up with. Any random string. It is just to encode/decode the state when going through the OAuth flow. It will encode it when generating the Add to Slack url. Then when your redirect url is hit (http://api.mydomain.com/slack/oauth_redirect), it will receive a payload from slack that returns the state value (which was the encoded one we passed when installing. The stateSecret will be used here to decode and verify state wasn’t tampered with by bad actors.

Let me know if you have any follow up questions! If not, can you close the issue 😄

[seratch]

Hi @anthonygualandri,

Is there a reason that the stateSecret isn’t an env variable?

This is a really good point. The document should encourage people to use an env variable for it too.

Is the stateSecret supposed to be generated randomly each time the app install process is called and so should be generated in the code itself every time?

No, it isn’t but we know that some people may want to do so (see also: https://github.com/slackapi/bolt-js/issues/1205#issuecomment-966723613) We may enhance this part in future releases.