-
Notifications
You must be signed in to change notification settings - Fork 80
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
signature does not match event payload and secret
when receiving JSON body
#593
Comments
Can you pin the version to 9.8.0 and see if it works? |
@gr2m Confirmed that v9.8.0 works, but not v9.8.1 or v9.8.2 |
I believe the bug lies somewhere within the At first glance, the code is exactly the same as what was removed in This is a strange issue. I can have a better look later today. |
@wolfy1339 I just investigated it a bit, and it seems like just app.post('/api/webhooks/github', async (req, res) => {
const matchesSignature = await webhooks.verify(
JSON.stringify(req.body),
req.headers['x-hub-signature-256']
);
if (!matchesSignature) {
res.sendStatus(400);
return;
}
await webhooks.receive({
id: req.headers['x-github-delivery'],
name: req.headers['x-github-event'],
payload: req.body,
});
res.sendStatus(200);
}); |
Thanks for that 👍 |
the issue is that the stringification does not work the same: original method:
new method
The new method adds new lines and indentation into the string, resulting in different hash |
But that's what GitHub does as far as I know. Does this fail in a testing environment for you, or in production? |
I was wrong, sorry. I should have verified my assumption before making this change. I now did by setting the webhook URL to https://httpbin.org/post and creating a test event. The response clearly shows that there are no extra white spaces anywhere in request body of webhook requests. |
🎉 This issue has been resolved in version 9.8.3 🎉 The release is available on: Your semantic-release bot 📦🚀 |
@mbazalik can you please test with 9.8.3? |
thanks @wolfy1339 for fixing so quickly! works perfectly now!! |
Hey all! I'm still receiving this error - I confirmed that my
I'm on |
@mrousavy Please see probot/probot#1973 probot/probot#1955 Please don't comment on old issues, open up a new one. And please only post your issue in one place |
What happened?
After updating
@octokit/webhooks
from v9.5.1 to v9.8.2, I now receive this error on all webhook eventsI am using the Express framework with the following middleware
What did you expect to happen?
For it to work as expected, and not be a breaking change.
What the problem might be
The problem is #587, which updated to the breaking change in
@octokit/webhooks-methods
, and seemingly added a compatibility layer, however that seems to have had no effect for my set up, resulting in the breaking change persisting.Changing the middleware to be this works:
The text was updated successfully, but these errors were encountered: