slack chat.postMessage API 端点不允许授权 header

Question

我在浏览器中有这段代码运行

<html>

    <script type="module">
        console.log("working");

        var url = "https://slack.com/api/chat.postMessage";
        var auth_token = "xoxb-2B"; //Your Bot's auth token
        var body = {channel: "ses", text: "testing app"}

        async function postData(url = '', data = {}) {
            // Default options are marked with *
            const response = await fetch(url, {
                method: 'POST', // *GET, POST, PUT, DELETE, etc.
                headers: {
                    "Authorization": "Bearer " + auth_token,
                    "Content-Type" : "application/json"
                },
                body: JSON.stringify(data) // body data type must match "Content-Type" header
            });
            return response.json(); // parses JSON response into native JavaScript objects
        }

        postData('https://slack.com/api/chat.postMessage', body)
        .then(data => {
            console.log(data); // JSON data parsed by `data.json()` call
        });
    </script>
</html>

我得到

在 'https://slack.com/api/chat.postMessage' 从来源 'http://127.0.0.1:5500' 获取的访问已被 CORS 策略阻止：Access-Control-Allow-Headers 在预检响应中不允许请求 header 字段授权。

我不明白，我需要以某种方式指定不记名令牌，即使在文档中它说要把它放在授权中 header，为什么他们不允许呢？

Answer 1

I don't understand, I need to specify the bearer token somehow, even in the docs it says to put it in the Authorization header, why aren't they allowing it?

这是一个不同的问题，与 Bearer 令牌完全无关。从你得到的错误来看，这意味着你用来获取 Slack API 的来源不受信任 (http://127.0.0.1:5500), there is nothing you can do from the browser since this is a policy that comes from the server which defines the authorized origins. (Learn more about CORS here) 由于我认为 Slack 不支持此功能，因此您需要从服务器获取 Slack API。

解决这个问题的一种方法是公开后端 API，例如：

Post a message to Slack	`Run in Fusebit`

router.post('/api/tenant/:tenantId/test', async (ctx) => {
  // Create a Slack client pre-configured with credentials necessary to communicate with your tenant's Slack workspace.
  // For the Slack SDK documentation, see https://slack.dev/node-slack-sdk/web-api.
  const slackClient = await integration.tenant.getSdkByTenant(ctx, connectorName, ctx.params.tenantId);

  // Get the Slack user ID associated with your tenant
  const slackUserId = slackClient.fusebit.credentials.authed_user.id;

  // Send a Direct Message to the Slack user
  const result = await slackClient.chat.postMessage({
    text: 'Hello world!',
    channel: slackUserId,
  });

  console.log('message response', result.message);
  ctx.body = { message: `Successfully sent a message to Slack user ${slackUserId}!` };
});

slack chat.postMessage API 端点不允许授权 header

slack chat.postMessage API endpoint is not allowing the authorization header

javascript

fetch-api

slack-api