fix(aws_lambda): handle null headers, query string, and body in API Gateway events by sahiljagtap08 · Pull Request #1587 · slackapi/bolt-python

sahiljagtap08 · 2026-10-07T00:11:46Z

Summary

API Gateway sends null, not a missing key, for request fields that have no value. For a REST API (payload format v1) headers, multiValueHeaders, and queryStringParameters are all null when the request has none of them. The AWS Lambda adapter assumed these were always dicts and raised AttributeError inside to_bolt_request, before the request reached the middleware chain.

Two related edge cases were fixed at the same time:

isBase64Encoded missing from the event raised KeyError. This happens when the function is invoked by test tooling or a custom integration that does not set the flag.
isBase64Encoded: true with a null body raised TypeError from base64.b64decode.

Changes in slack_bolt/adapter/aws_lambda/handler.py:

Every event field lookup treats None the same as a missing key.
The base64 decode only runs when the flag is true and a body is present.
The headers dict is copied before the cookie header is added, so the caller's event is left untouched.
A short comment explains why the null handling is there.

Testing

New tests in tests/adapter_tests/aws/test_aws_lambda.py:

test_null_fields_in_api_gateway_event: null headers, multiValueHeaders, and queryStringParameters now produce a 401 (no signature) instead of a crash, and the original event is not modified.
test_missing_is_base64_encoded_and_null_body: covers the missing flag and the null body with the flag set.
test_base64_encoded_body: a properly signed base64-encoded body is decoded and handled with a 200.

Both crash tests fail on main and pass with this change. Ran ./scripts/format.sh, ./scripts/lint.sh, ./scripts/run_mypy.sh, and the adapter test suite.

Requirements

I've read and understood the Contributing Guidelines and have done my best effort to follow them.
I've read and agree to the Code of Conduct.
I've run ./scripts/install_all_and_run_tests.sh after making the changes.

salesforce-cla · 2026-10-07T00:11:52Z

Thanks for the contribution! Before we can merge this, we need @sahiljagtap08 to sign the Salesforce Inc. Contributor License Agreement.

srtaalej

thank you for opening this PR @sahiljagtap08! l'll give it a more thorough review once the CLA is signed and CI passes 😸

sahiljagtap08 · 2026-10-08T00:07:51Z

recheck

…ateway events API Gateway sends null, not a missing key, for request fields that have no value. For example "headers", "multiValueHeaders" and "queryStringParameters" are null when the request has none of them. The Lambda adapter assumed these were always dicts and raised AttributeError before the request was dispatched. It also raised KeyError when "isBase64Encoded" was absent, and TypeError when the flag was true but the body was null. - Treat None the same as a missing key for every event field - Copy the headers dict so the caller's event is not modified - Add tests for null fields, a missing base64 flag, and a real base64-encoded body

sahiljagtap08 · 2026-10-08T00:24:47Z

The CLA is signed and the check is passing on this one too. Happy to make any changes if needed.

codecov · 2026-10-08T15:55:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.57%. Comparing base (3774392) to head (cd85e58).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1587      +/-   ##
==========================================
+ Coverage   91.54%   91.57%   +0.02%     
==========================================
  Files         228      228              
  Lines        7285     7285              
==========================================
+ Hits         6669     6671       +2     
+ Misses        616      614       -2

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

srtaalej

@sahiljagtap08 this PR looks good! thank you for adding stricter checks and tests to the lambda adapter! i left some suggestions to keep our code clean!

srtaalej · 2026-10-08T20:41:56Z

+    # API Gateway sends null (not a missing key) for fields that have no value,
+    # such as "headers", "multiValueHeaders" and "queryStringParameters".
+    # Every lookup below treats None the same as a missing key.


lets get rid of these comments

Suggested change

# API Gateway sends null (not a missing key) for fields that have no value,

# such as "headers", "multiValueHeaders" and "queryStringParameters".

# Every lookup below treats None the same as a missing key.

srtaalej · 2026-10-08T20:42:13Z

-            cookies = multiValueHeaders.get("Cookie", [])
-    headers = event.get("headers", {})
+            cookies = multiValueHeaders.get("Cookie") or []
+    # Copy the headers so the caller's event dict is left untouched


same as above

Suggested change

# Copy the headers so the caller's event dict is left untouched

srtaalej · 2026-10-08T20:42:53Z

+        # API Gateway sends null for headers, multiValueHeaders and queryStringParameters
+        # when the request has none. These used to crash before the request was dispatched.


same as above

Suggested change

# API Gateway sends null for headers, multiValueHeaders and queryStringParameters

# when the request has none. These used to crash before the request was dispatched.

srtaalej · 2026-10-08T20:43:24Z

+        # isBase64Encoded is absent (for example when invoked from a test tool)
+        event = {"requestContext": {"http": {"method": "POST"}}, "headers": {}, "body": "{}"}
+        assert SlackRequestHandler(app).handle(event, self.context)["statusCode"] == 401
+        # isBase64Encoded is true but the body is null


Suggested change

# isBase64Encoded is true but the body is null

srtaalej · 2026-10-08T20:43:33Z

+            "isBase64Encoded": False,
+        }
+        response = SlackRequestHandler(app).handle(event, self.context)
+        # No signature headers, so the request is rejected rather than crashing


Suggested change

# No signature headers, so the request is rejected rather than crashing

srtaalej · 2026-10-08T20:43:42Z

+        response = SlackRequestHandler(app).handle(event, self.context)
+        # No signature headers, so the request is rejected rather than crashing
+        assert response["statusCode"] == 401
+        # The caller's event must not be modified


Suggested change

# The caller's event must not be modified

srtaalej · 2026-10-08T20:44:01Z

+
+    def test_missing_is_base64_encoded_and_null_body(self):
+        app = App(client=self.web_client, signing_secret=self.signing_secret)
+        # isBase64Encoded is absent (for example when invoked from a test tool)


Suggested change

# isBase64Encoded is absent (for example when invoked from a test tool)

sahiljagtap08 · 2026-10-08T21:02:33Z

@srtaalej thanks for the review and the approval! Applied all your suggestions and removed those comments. Checks pass locally.

sahiljagtap08 requested a review from a team as a code owner October 7, 2026 00:11

salesforce-cla Bot added the cla:missing label Oct 7, 2026

srtaalej reviewed Oct 7, 2026

View reviewed changes

sahiljagtap08 force-pushed the fix/aws-lambda-null-event-fields branch from ae7ccba to f62cda5 Compare October 8, 2026 00:09

salesforce-cla Bot added cla:signed and removed cla:missing labels Oct 8, 2026

srtaalej self-requested a review October 8, 2026 18:28

srtaalej approved these changes Oct 8, 2026

View reviewed changes

Merge branch 'main' into fix/aws-lambda-null-event-fields

5ef55c6

srtaalej assigned sahiljagtap08 Oct 8, 2026

srtaalej added enhancement New feature or request bug Something isn't working labels Oct 8, 2026

chore(aws_lambda): remove inline comments per review

cd85e58

srtaalej merged commit 698687c into slackapi:main Oct 8, 2026
16 checks passed

	# API Gateway sends null (not a missing key) for fields that have no value,
	# such as "headers", "multiValueHeaders" and "queryStringParameters".
	# Every lookup below treats None the same as a missing key.

		# API Gateway sends null for headers, multiValueHeaders and queryStringParameters
		# when the request has none. These used to crash before the request was dispatched.

Conversation

sahiljagtap08 commented Oct 7, 2026

Summary

Testing

Category

Requirements

Uh oh!

salesforce-cla Bot commented Oct 7, 2026

Uh oh!

srtaalej left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sahiljagtap08 commented Oct 8, 2026

Uh oh!

sahiljagtap08 commented Oct 8, 2026

Uh oh!

codecov Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

srtaalej left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

srtaalej Oct 8, 2026

Choose a reason for hiding this comment

Uh oh!

srtaalej Oct 8, 2026

Choose a reason for hiding this comment

Uh oh!

srtaalej Oct 8, 2026

Choose a reason for hiding this comment

Uh oh!

srtaalej Oct 8, 2026

Choose a reason for hiding this comment

Uh oh!

srtaalej Oct 8, 2026

Choose a reason for hiding this comment

Uh oh!

srtaalej Oct 8, 2026

Choose a reason for hiding this comment

Uh oh!

srtaalej Oct 8, 2026

Choose a reason for hiding this comment

Uh oh!

sahiljagtap08 commented Oct 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

srtaalej left a comment •

edited

Loading

codecov Bot commented Oct 8, 2026 •

edited

Loading

srtaalej left a comment •

edited

Loading