Skip to content

Cookie auth terminates browser Slack session #45

@zomglings

Description

@zomglings

Problem

Using --mode cookie authentication causes Slack to log out the browser session.

Reproduction

  1. Login to Slack in browser
  2. Extract xoxc token and d cookie
  3. Run clacks auth login --mode cookie
  4. Use any clacks command (read, send, etc.)
  5. Browser Slack session gets terminated

Root Cause

The cookie auth implementation only sets Cookie: d={cookie} header but doesn't spoof browser headers like User-Agent, Accept, etc.

Slack likely detects non-browser client using the session token and terminates it as a security measure.

Suggested Fix

Add browser-like headers to cookie auth requests:

client = WebClient(
    token=token,
    headers={
        "Cookie": f"d={cookie}",
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
        "Accept": "application/json",
        "Accept-Language": "en-US,en;q=0.9",
    }
)

This would make API requests look more like legitimate browser requests and avoid session termination.

Impact

Currently cookie auth is unusable for regular work as it constantly logs users out of Slack in their browser, defeating the purpose of the stopgap authentication method.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions