Switch auth from Safari cookies to Slack desktop app#7
Closed
Conversation
Implements the auth approach from gh-slack (rneatherway/slack): reads the 'd' cookie from the Slack desktop app's SQLite cookie database, decrypts it using the system keychain, and exchanges it for a Slack API token. Supports macOS (Keychain via security CLI) and Linux (Secret Service via secret-tool). No longer requires Safari or TLS fingerprinting. Co-authored-by: wham <448809+wham@users.noreply.github.com>
Co-authored-by: wham <448809+wham@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Investigate auth parsing in gh-slack from Slack app
Switch auth from Safari cookies to Slack desktop app
Feb 22, 2026
wham
requested changes
Feb 22, 2026
AGENTS.md
Outdated
| - `main.go` — Entry point with cobra root command, flags (`--test`, `-o`), and `slog`-based logging | ||
| - `internal/auth/safari.go` — Safari cookie auth provider with uTLS fingerprinting, binary cookie parsing, and Slack token extraction | ||
| - `internal/auth/desktop.go` — Slack desktop app cookie auth provider: reads the `d` cookie from Slack's SQLite cookie database, decrypts it using the system keychain, and exchanges it for a Slack API token | ||
| - `internal/auth/safari.go` — Legacy Safari cookie auth provider (retained for reference) |
Contributor
Author
There was a problem hiding this comment.
Removed safari.go, safari_test.go, cleaned up AGENTS.md references, and dropped the unused utls/brotli/compress dependencies in 668f5bd.
Contributor
Author
There was a problem hiding this comment.
Done — all legacy Safari code removed in 668f5bd.
Delete safari.go and safari_test.go, clean up AGENTS.md references, and remove unused utls/brotli/compress dependencies. Co-authored-by: wham <448809+wham@users.noreply.github.com>
…t uTLS fingerprinting
Owner
|
I realized reading the desktop DB triggers macOS keychain access dialog. The Safari implementation is more convenient in a way. Punting for now. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the auth approach from gh-slack (via rneatherway/slack): reads the
dcookie from the Slack desktop app's SQLite cookie database instead of parsing Safari's binary cookies.Auth flow
~/Library/Application Support/Slack/Cookieson macOS,~/.config/Slack/Cookieson Linux)dcookie viamodernc.org/sqlite(pure Go, no CGo)securityCLI) or Linux Secret Service (secret-tool)Changes
internal/auth/desktop.go— NewDesktopProviderimplementing the full flow aboveinternal/auth/desktop_test.go— Tests for AES-CBC decryption, domain hash prefix stripping, provider interfacemain.go— WireDesktopProviderin place ofSafariProvider, update--testflag and help textREADME.md/AGENTS.md— Updated docssafari.go/safari_test.go— Legacy Safari auth code fully deletedutls,brotli,klauspost/compressdropped viago mod tidyWhy
utls)Original prompt
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.