Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

verify payload signature if present #2732

Merged
merged 1 commit into from Apr 1, 2023
Merged

verify payload signature if present #2732

merged 1 commit into from Apr 1, 2023

Commits on Mar 31, 2023

  1. verify payload signature if present 

    Verify the payload signature if the request has a signature present in
HTTP headers, or if a non-empty secretToken is passed to the
ValidatePayload method, indicating that a signature is expected.

This modifies the behavior added in #1127, but not the spirit of what
was requested in #1126, which is to support webhooks that don't have
configured secrets.

Specifically, this no longer allows signature checking to be skipped
entirely, even for webhooks with a configured secret, simply by passing
an empty secretToken to ValidatePayload.

Fixes #2731
    @willnorris
    willnorris committed Mar 31, 2023
    Configuration menu
    Copy the full SHA
    5920108 View commit details
    Browse the repository at this point in the history