title: Nim Slack bot Signature Verification Issues
body: <p>I'm fairly new to Nim, and I suspect I'm just doing something wrong here. I'm using Jester (for routing, etc) and Nimcrytpo (for hmac) but something isn't adding up. Here's how I'm attempting to verify a signature:</p>
  <pre><code>import jester
  import dotenv
  import os, strutils, times
  import nimcrypto
  
  const timestampHeader = &quot;X-Slack-Request-Timestamp&quot;
  const slackSignatureHeader = &quot;X-Slack-Signature&quot;
  const signatureVersion = &quot;v0&quot;
  const signingSecret = os.getEnv(&quot;SLACK_SIGNING_SECRET&quot;)
  
  proc isTimestampRecent(timestamp: int): bool =
    abs(getTime().toUnix - timestamp) &lt;= (60 * 5)
  
  proc verifySignature*(request: Request): bool =
    if (not request.headers.hasKey timestampHeader) or
    (not request.headers.hasKey slackSignatureHeader):
      return false
  
    let timestamp = request.headers[timestampHeader].parseInt
    if not timestamp.isTimestampRecent():
      return false
  
    let baseString = signatureVersion &amp; ':' &amp; $timestamp &amp; ':' &amp; $request.body
    let mySignature = sha256.hmac(signingSecret, baseString)
  
    let slackSignature = MDigest[256].fromHex(request.headers[slackSignatureHeader])
  
    mySignature == slackSignature
  </code></pre>
  <p>A few things I'm running into:</p>
  <ol>
  <li>The signature doesn't match, and I'm not really sure how to debug that. I'm definitely getting a valid request from Slack and following the instructions for verification here: <a href="https://api.slack.com/authentication/verifying-requests-from-slack#about" rel="nofollow noreferrer">https://api.slack.com/authentication/verifying-requests-from-slack#about</a>, but it's incorrect.</li>
  <li>I know I'm missing the <code>v0=</code> in the comparison, but I'm not quite sure how to do that with the time independent comparison (whether I should be skipping that part or not in the comparison, etc)</li>
  </ol>
  <p>My best guess at this point is that somehow the Jester/Httpbeast request body isn't &quot;raw&quot; enough (though it's just plain json...?) or is somehow processed.</p>
  <p>Any help or suggestions on how to debug would be greatly appreciated. Thank you in advance!</p>