From aacee3ad9be35f7aeb55bbc36d8885161e04c7cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 19 Oct 2026 14:51:17 +0200 Subject: [PATCH] docs(slack): clarify workspace restriction setting Explain that Slack workspace IDs are checked on callback so operators can update settings that used names or organization IDs. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-YD5NDKHE. --- docs/backends/slack.rst | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/backends/slack.rst b/docs/backends/slack.rst index 615912bf..eea4cb99 100644 --- a/docs/backends/slack.rst +++ b/docs/backends/slack.rst @@ -33,9 +33,17 @@ Slack See auth scopes at `Slack OAuth docs`_. -- Limiting by team is possible by:: +- To allow sign-in only from one Slack workspace, set its workspace ID:: - SOCIAL_AUTH_SLACK_TEAM = '' + SOCIAL_AUTH_SLACK_TEAM = 'T0123456789' + + The backend checks the ``team.id`` returned by Slack's ``users.identity`` + response before signing in. The ``team`` authorization parameter selects a + workspace on Slack's sign-in page, but does not enforce this restriction. + A missing or different workspace ID rejects the sign-in. Configure a + workspace ID (starting with ``T``), not a workspace name or Enterprise + organization ID (starting with ``E``). Deployments previously using a name + or organization ID must update this setting before upgrading. .. _Slack: https://api.slack.com/applications .. _Slack OAuth docs: https://api.slack.com/docs/oauth