Enhancement: Assistant should inherit global middleware for security and consistency #1346
Description
Problem
Assistant handlers bypass global middleware entirely, creating a significant security gap and architectural inconsistency. Assistant events, assistant.user_message, assistant.thread_started etc. skip critical middleware that regular events receive, including:
- SSL certificate verification
- Request signature verification
- Authorization middleware
- URL verification
- Custom middleware
This forces developers to manually implement security checks in each assistant handler, which is error-prone and violates the principle of secure-by-default design.
# These handlers get full middleware protection:
@app.event("app_mention")
async def handle_mention(event, say, context):
# Already authenticated via middleware
pass
# These handlers bypass ALL middleware (security vulnerability):
@assistant.user_message
async def handle_message(event, say, context):
# No authentication, no SSL check, no signature verification!
pass
Developer Experience: Developers must remember to add security manually to every assistant handler:
# Current: Manual security in every handler (error-prone)
@assistant.user_message(middleware=[auth_middleware, ssl_middleware])
async def handle_message(event, say, context):
pass
Category
- slack_bolt.App and/or its core components
- slack_bolt.async_app.AsyncApp and/or its core components
- Adapters in slack_bolt.adapter
- Others
Requirements
Proposed Solution
Enhance Assistant/AsyncAssistant to automatically inherit the app's global middleware when handlers are registered. This would:
- Maintain backwards compatibility - existing explicit middleware still works
- Provide opt-in enhancement - controlled via auto_inherit_app_middleware=True parameter
- Apply middleware in correct order - app middleware first, then handler-specific middleware
Benefits
- Security by default - Assistant events get same protection as regular events
- Architectural consistency - All Slack events treated uniformly
- Developer productivity - No more manual security boilerplate
- Backwards compatible - Existing code continues working unchanged
- Performance neutral - Middleware already exists, just applied consistently