Slack OAuth Authentication is broken

This incident has been marked as resolved

Final update as we are marking the issue as resolved. After digging through some more with the help of Krishnan, the issue happens consistently when using an Outlook account, but we were not able to reproduce the issue with GSuite accounts in brand new workspaces. Given that, and the relatively low volume of users affected this week (3), we will be marking this incident as resolved once we merge in Sam's follow up to the hotfix we previously deployed. We will follow up with M365 next week for further investigation.

We're currently deploying a hotfix for this. There is an optional parameter in the auth flow that can be passed in to protect from forgery attacks that is not sent when the auth flow originates from the Slack app directory. The code made the assumption that this parameter would always be passed in, causing it it failed erroneously. We'll verify the fix once it's deployed and report.

Quick update on the customer impact, it's significantly lower than we originally estimated. We've seen 27 instances of this failure in the past week affecting 4 orgs (clockwise, clockwise microsoft, nubank (3 ppl), and seatgeek (1 person)) against way more successful sign ups and logins. We're still working on determining the cause of the failure.

We're currently investigating an issue that is preventing customers from signing in or up using Slack's OAuth flow. It seems we're not returning the correct verification code during the process and are currently investigating the reason why.

We are currently investigating this issue.