ignore casing of HTTP headers as requested by RFC (#937)

src/receivers/AwsLambdaReceiver.spec.ts

@@ -133,6 +133,87 @@ describe('AwsLambdaReceiver', function () {
       assert.equal(response2.statusCode, 200);
     });
 
+    it('should accept proxy events with lowercase header properties', async (): Promise<void> => {
+      const awsReceiver = new AwsLambdaReceiver({
+        signingSecret: 'my-secret',
+        logger: noopLogger,
+      });
+      const handler = awsReceiver.toHandler();
+      const timestamp = Math.floor(Date.now() / 1000);
+      const body = JSON.stringify({
+        token: 'fixed-value',
+        team_id: 'T111',
+        enterprise_id: 'E111',
+        api_app_id: 'A111',
+        event: {
+          client_msg_id: '977a7fa8-c9b3-4b51-a0b6-3b6c647e2165',
+          type: 'app_mention',
+          text: '<@U222> test',
+          user: 'W111',
+          ts: '1612879521.002100',
+          team: 'T111',
+          channel: 'C111',
+          event_ts: '1612879521.002100',
+        },
+        type: 'event_callback',
+        event_id: 'Ev111',
+        event_time: 1612879521,
+        authorizations: [
+          {
+            enterprise_id: 'E111',
+            team_id: 'T111',
+            user_id: 'W111',
+            is_bot: true,
+            is_enterprise_install: false,
+          },
+        ],
+        is_ext_shared_channel: false,
+        event_context: '1-app_mention-T111-C111',
+      });
+      const signature = crypto.createHmac('sha256', 'my-secret').update(`v0:${timestamp}:${body}`).digest('hex');
+      const awsEvent = {
+        resource: '/slack/events',
+        path: '/slack/events',
+        httpMethod: 'POST',
+        headers: {
+          accept: 'application/json,*/*',
+          'content-type': 'application/json',
+          host: 'xxx.execute-api.ap-northeast-1.amazonaws.com',
+          'user-agent': 'Slackbot 1.0 (+https://api.slack.com/robots)',
+          'x-slack-request-timestamp': `${timestamp}`,
+          'x-slack-signature': `v0=${signature}`,
+        },
+        multiValueHeaders: {},
+        queryStringParameters: null,
+        multiValueQueryStringParameters: null,
+        pathParameters: null,
+        stageVariables: null,
+        requestContext: {},
+        body: body,
+        isBase64Encoded: false,
+      };
+      const response1 = await handler(
+        awsEvent,
+        {},
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        (_error, _result) => {},
+      );
+      assert.equal(response1.statusCode, 404);
+      const App = await importApp();
+      const app = new App({
+        token: 'xoxb-',
+        receiver: awsReceiver,
+      });
+      app.event('app_mention', async ({}) => {});
+      const response2 = await handler(
+        awsEvent,
+        {},
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        (_error, _result) => {},
+      );
+      assert.equal(response2.statusCode, 200);
+    });
+
     it('should accept interactivity requests', async (): Promise<void> => {
       const awsReceiver = new AwsLambdaReceiver({
         signingSecret: 'my-secret',

src/receivers/AwsLambdaReceiver.ts

@@ -109,7 +109,11 @@ export default class AwsLambdaReceiver implements Receiver {
 
       const rawBody: string = typeof awsEvent.body === 'undefined' || awsEvent.body == null ? '' : awsEvent.body;
 
-      const body: any = this.parseRequestBody(rawBody, awsEvent.headers['Content-Type'], this.logger);
+      const body: any = this.parseRequestBody(
+        rawBody,
+        this.getHeaderValue(awsEvent.headers, 'Content-Type'),
+        this.logger,
+      );
 
       // ssl_check (for Slash Commands)
       if (
@@ -122,8 +126,8 @@ export default class AwsLambdaReceiver implements Receiver {
       }
 
       // request signature verification
-      const signature = awsEvent.headers['X-Slack-Signature'] as string;
-      const ts = Number(awsEvent.headers['X-Slack-Request-Timestamp']);
+      const signature = this.getHeaderValue(awsEvent.headers, 'X-Slack-Signature') as string;
+      const ts = Number(this.getHeaderValue(awsEvent.headers, 'X-Slack-Request-Timestamp'));
       if (!this.isValidRequestSignature(this.signingSecret, rawBody, signature, ts)) {
         return Promise.resolve({ statusCode: 401, body: '' });
       }
@@ -243,4 +247,10 @@ export default class AwsLambdaReceiver implements Receiver {
 
     return true;
   }
+
+  // eslint-disable-next-line class-methods-use-this
+  private getHeaderValue(headers: Record<string, any>, key: string): string | undefined {
+    const caseInsensitiveKey = Object.keys(headers).find((it) => key.toLowerCase() === it.toLowerCase());
+    return caseInsensitiveKey !== undefined ? headers[caseInsensitiveKey] : undefined;
+  }
 }