set accessToken to header

packages/slackbot-proxy/src/controllers/growi-to-slack.ts

@@ -104,12 +104,17 @@ export class GrowiToSlackCtrl {
       const url = new URL('/_api/v3/slack-integration/proxied/commands', order.growiUrl);
       await axios.post(url.toString(), {
         type: 'url_verification',
-        tokenPtoG: order.growiAccessToken,
         challenge: 'this_is_my_challenge_token',
+      },
+      {
+        headers: {
+          'x-growi-ptog-tokens': order.growiAccessToken,
+        },
       });
     }
     catch (err) {
       logger.error(err);
+      return res.status(400).send({ message: 'growiAccessToken is invalid' });
     }
 
     logger.debug('order found', order);

src/server/routes/apiv3/slack-integration.js

@@ -13,7 +13,15 @@ module.exports = (crowi) => {
   const { configManager } = crowi;
 
   // Check if the access token is correct
-  function verifyAccessTokenFromProxy(req, res, next) {
+  async function verifyAccessTokenFromProxy(req, res, next) {
+    const token = req.headers['x-growi-ptog-tokens'];
+
+    if (token == null) {
+      const message = 'The value of header \'x-growi-ptog-tokens\' must not be empty.';
+      logger.warn(message, { body: req.body });
+      return res.status(400).send({ message });
+    }
+
     const { body } = req;
     const { tokenPtoG } = body;