Add volunteer-near slash address

[daniel-j-pease]

Feedback very extremely welcome!

[ktomanelli]

Looks good! Only thing I'd say is to add a check to verify the post request is coming from slack and not someone else.

You can verify with this function:
const slackConf = req => { const reqBody = qs.stringify(req.body, { format: 'RFC1738' }); const timeStamp = req.headers['x-slack-request-timestamp']; const slackSig = req.headers['x-slack-signature']; if (Math.abs(Math.floor(Date.now() / 1000) - timeStamp) > 300) { return false; } const baseString = v0:${timeStamp}:${reqBody}; const mySecret = v0=${crypto
.createHmac('sha256', slackSecret)
.update(baseString)
.digest('hex')}`;

if (
crypto.timingSafeEqual(
Buffer.from(mySecret, 'utf8'),
Buffer.from(slackSig, 'utf8')
)
) {
return true;
}
return false;
};`
You'll need to require crypto, and qs as well as have the slack signing secret and slack token.

Here's the doc page I used to make it a while ago: https://api.slack.com/authentication/verifying-requests-from-slack.

[daniel-j-pease]

Looks good! Only thing I'd say is to add a check to verify the post request is coming from slack and not someone else.

You can verify with this function:
const slackConf = req => { const reqBody = qs.stringify(req.body, { format: 'RFC1738' }); const timeStamp = req.headers['x-slack-request-timestamp']; const slackSig = req.headers['x-slack-signature']; if (Math.abs(Math.floor(Date.now() / 1000) - timeStamp) > 300) { return false; } const baseString = v0:${timeStamp}:${reqBody}; const mySecret = v0=${crypto
.createHmac('sha256', slackSecret)
.update(baseString)
.digest('hex')}`;

if (
crypto.timingSafeEqual(
Buffer.from(mySecret, 'utf8'),
Buffer.from(slackSig, 'utf8')
)
) {
return true;
}
return false;
};`
You'll need to require crypto, and qs as well as have the slack signing secret and slack token.

Here's the doc page I used to make it a while ago: https://api.slack.com/authentication/verifying-requests-from-slack.

Makes sense thank you!