It’s incredible how small changes can trickle into big problems. This happened to us last week when the Slack community invite we’ve been using forever suddenly stopped working. Here’s what happened and how you can fix it for yourself.
TLDR: Slack changed how invite links work, it not only broke our ability to have people join our community but actually compromised the privacy of our users. We were lucky, we caught it immediately and were able to fix it.
We got an email from someone saying they couldn’t sign up for our Slack community using the link on our website. Instead of bringing them to a page where they could create an account by typing in their email and getting a confirmation code- they were redirected to a domain sign-up page.
This sign-up page had a few problems. First, it ended up putting them in an infinite loop of trying to sign up but being denied because their email domain didn’t match those of the list of “pre-approved” domains. Using Google or Apple SSO made no difference, they still received the same error.
The second, and possibly more concerning issue was that the list of email domains that “we approved” to join the community was seemingly curated automatically from emails of members that had already joined! 😱 This means anyone who signed up to our community with their work email – that company’s email domain was open to anyone to see! (This could lead to some real privacy and even security (phishing) emails that were quite concerning to us.)
We jumped all over this to figure out how to fix this sign-up process that had been flawless the day before. I was all over Google. “Slack domain email whitelist”, “Slack set up invitation link”, and even “Slack invite link type email” - all useless! Everything I googled brought me back to the same pages from the Slack help center, pointing me to my workspace settings.
The Solution:
First, go to your Slack workspace settings to remove all the domains of companies that are being listed. Obviously, it might take some time to replace the invite links throughout your app or anywhere else you might be using them. So you want to make sure that you protect your community’s privacy by removing them from the approved domain list on the “Join this Workspace” settings and permissions page.
After much clicking and digging it turns out you don’t want Slack workspace settings to create a new invite link at all. Instead, go to your community Slack and click the down arrow.
The first option is “Invite people to {your community}"- click this.
At the bottom of this popup is an invite link that you can copy to your clipboard- and the ability to edit the link settings. Click “Edit link settings.”
You can set this link never to expire. Then hit save.
The caveat is Slack recently changed the inviting structure so that links automatically expire or they are only good for a maximum of 400 sign-ups. Depending on the size of your community and how fast it’s growing, this could be a problem for you.
But here’s an insider tip: if you reach out to Slack support, they have been known to work with bigger communities to create a link that is good for more sign-ups!
Once you customize your link, copy it to your clipboard and send it out.
When people use this new link, they can enter or type in their email and get a one-time passcode to complete the login process.
Voilà! Follow these steps to give your new community members the freedom to sign up to your Slack with any email. The team at Shipyard is dedicated to the privacy and security of its members. And the members of other Slack communities, hence why we took the time to write this blog post and share it with the world.
If you have any additional info or experiences related to this, feel free to contact us or join our Shipyard community Slack.
