Summary

• Reject empty signingSecret ('') at initialization across all receivers and in the request verification layer to prevent accidental verification bypass
• Add a shared verifySigningSecret() helper that validates the signing secret is a non-empty string when signature verification is enabled
• Add comprehensive unit tests for the new validation across App, HTTPReceiver, ExpressReceiver, AwsLambdaReceiver, verifyRequest, and verifySigningSecret

Motivation

Previously, passing an empty string ('') as signingSecret did not trigger an error, the value is truthy enough to pass === undefined checks but propagates to createHmac("sha256", ""), which produces a valid HMAC keyed with an empty secret. This would bypass the request verification without warning the user.

The proper way to disable signature verification is by setting signatureVerification: false

Reproduction

Server with issue (app.js):

import { App } from '@slack/bolt';

const app = new App({
  signingSecret: '',
  port: 3000,
  authorize: async () => ({ botToken: 'xoxb-fake', botId: 'B000', botUserId: 'U000' }),
});

app.event('app_mention', async ({ event }) => {
  console.log(`Received app_mention from ${event.user}: ${event.text}`);
});

await app.start();
console.log('Vulnerable server listening on :3000');

Forged request:

TIMESTAMP=$(date +%s) && \
BODY='{"type":"url_verification","challenge":"bypass-confirmed"}' && \
curl -X POST http://localhost:3000/slack/events \
  -H "Content-Type: application/json" \
  -H "x-slack-request-timestamp: $TIMESTAMP" \
  -H "x-slack-signature: v0=$(printf "v0:${TIMESTAMP}:${BODY}" | openssl dgst -sha256 -hmac '' | awk '{print $NF}')" \
  -d "$BODY"

With this fix applied, the App constructor now throws an AppInitializationError and receivers throw a ReceiverInitializationError, preventing the server from starting with an empty signing secret.

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.