Proper use of state parameter for the OAuth CSRF protection

[seratch]

As of Feb 2022, @slack/oauth (~ v2.4) and @slack/bolt (~ v3.10) do not use state parameter for the purpose of CSRF protection in the Slack OAuth flow. Refer to the RFC https://datatracker.ietf.org/doc/html/rfc6749#section-10.12 for the details of state parameter in general.

Currently, the only things that InstallProvider does are adding state parameter to the Slack authorize URL, and then decoding the underlying value from the string. There is no way for developers to check if the state parameter in query string is valid for the accessing user-agent (=the web browser).

To improve this, @slack/oauth module can provide a new way to serve the install path (/slack/install) in a way to manage user-agent state by setting cookies. With that, the Redirect URL (/slack/oauth_redirect) can check if the user-agent is the same person in the OAuth flow.

We will add a new method handleInstallPath(), which handles all the above. Also, the existing handleCallback() verifies both the query string and browser cookies. Newer versions of bolt-js (v3.11 or newer) will switch to this new way.

Packages:

Select all that apply:

• @slack/web-api
• @slack/rtm-api
• @slack/webhooks
• @slack/oauth
• @slack/socket-mode
• I don't know