Webhook endpoint returns 500 instead of 401 when X-Hub-Signature-256 header is missing

[ChristoRibeiro]

Summary

The GitHub webhook endpoint returns HTTP 500 Internal Server Error when the X-Hub-Signature-256 header is missing, instead of the expected HTTP 401 Unauthorized.

Steps to reproduce

Send a POST to your Dokploy webhook endpoint with a well-formed GitHub-like JSON payload but without the X-Hub-Signature-256 header:

curl -sS -X POST "https://<your-dokploy>/api/deploy/github" \
  -H "Content-Type: application/json" \
  -H "X-GitHub-Event: push" \
  -H "X-GitHub-Delivery: test-$(uuidgen)" \
  -d '{"action":"test","installation":{"id":<valid-installation-id>},"repository":{"full_name":"foo/bar"}}'

Expected

HTTP 401 Unauthorized with a structured error body (e.g. {"message":"Missing signature header"}), consistent with the response for an invalid signature.

Actual

HTTP 500 Internal Server Error with body Internal Server Error.

Context

• Dokploy v0.29.1
• Consistent behavior: sending a wrong signature header returns 401 correctly — only a missing header crashes into 500.
• Likely cause: the HMAC comparison path raises when X-Hub-Signature-256 is undefined before the nullity check.

Why it matters

• Not a security hole (the signature check still prevents unauthorized deploys), but 500 makes monitoring noisy, can pollute error-tracking (Sentry etc.), and implies server-side crash instead of expected auth rejection.
• Fix should be trivial: normalize missing-header and bad-signature into the same 401 branch.

[dosubot]

Hi @ChristoRibeiro! I'm Dosu and I’m helping the dokploy team.

Good catch. The root cause is in apps/dokploy/pages/api/deploy/github.ts. The signature header is read at line 26 but never null-checked before being passed to webhooks.verify() with an unsafe as string cast [1]:

const signature = req.headers["x-hub-signature-256"];
// ...
const verified = await webhooks.verify(
    JSON.stringify(githubBody),
    signature as string, // undefined when header is missing → throws
);

When signature is undefined, the @octokit/webhooks verify() method throws instead of returning false, which bubbles up as a 500. The existing if (!verified) → 401 block at lines 56-59 never gets reached.

The fix would be adding an early guard before the verify call:

const signature = req.headers["x-hub-signature-256"];

if (!signature) {
    res.status(401).json({ message: "Unauthorized" });
    return;
}

Worth noting that the other webhook endpoints (GitLab, Bitbucket, etc.) may have a similar pattern and could benefit from the same check.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.