I'm making a Google Chat bot with NestJS. It accepts slash commands and allows for interaction with an already existing system. The messages returned on the POST endpoint sometimes include private info or JWTs, so I need to improve security.
I need a way to authenticate and reliably identify the user that triggered the bot command. Currently I'm using the user email provided in the POST body and validating the Bearer token from the header.
Is there a good way to authenticate the user and make sure someone didn't just change the email in the request body?
A solution that could work:
Instead of returning the reply message contents in the POST response, send the message directly to the user it was requested for.
So even if someone changes the email in the request body to someone elses, they do not get the reply, only the requested email gets it.
You can verify the authenticity of the app by checking the bearer token send it to the server
POST
Host: yourappurl.com
Authorization: Bearer AbCdEf123456
Content-Type: application/json
User-Agent: Google-Dynamite
Google Chat includes a bearer token in the
Authorizationheader of every HTTPS Request to an app.
You can verify your bearer token using an open source Google API client library, in your case Node.js
You can review the full guide here