4 ms·
Show HN: Automatically Thank Patreon Backers with OpenFaaS
- koolba 9y agoBeen a while since I've used Python but I'm pretty sure this code isn't performing any validation the inbound events[1]. I'd expect some kind of signature validation or a call out to a Patreon API to verify the authenticity of the request. Otherwise if I know the endpoint of this handler I can get it to tweet anything I'd like from your account with a simple cURL request. Could also specify a dummy patron_link and get the service to bombard it. [1]: https://github.com/openfaas/backer-thankyou/blob/15c22da638f982623680187dd8220978a88baa81/patreon-responder/handler.py#L15 https://github.com/openfaas/backer-thankyou/blob/15c22da638f...
- hnarn 9y agoAs someone who barely uses curl, could you give an example of a curl command that would send this kind of request?
- j_s 9y agoOne great way to get curl commands is the Chrome Developer Tools Network tab's 'Copy > Copy as curl' right click menu option.
- notamy 9y agoIt's not. It should be verifying the signature in the X-Patreon-Signature header (which should match the body signed with the webhook secret iirc).
- alexellisuk 9y agoYes you can perform HMAC validation - here's an example of HMAC in Ruby and Go - https://blog.alexellis.io/swarm-secrets-in-action/ https://blog.alexellis.io/swarm-secrets-in-action/ - https://github.com/openfaas/faas-cli/blob/master/sample/github_hmac/handler.go https://github.com/openfaas/faas-cli/blob/master/sample/gith... This is how I'm validating HMAC in Python for the backers code - https://github.com/openfaas/backer-thankyou/blob/master/patreon-responder/validate.py https://github.com/openfaas/backer-thankyou/blob/master/patr...
- notamy 9y agoAh, my bad, I completely missed that >_<
- alexellisuk 9y agoYes you can "if" you know the URL and submit a valid payload. HMAC is optional but advisory.
- zaarn 9y agoThat does kind of take the sincerity out of it, in my opinion. Atleast in a small community it should be no problem to thank supporters individually and that is IMO more important than automating the task.
- alexellisuk 9y agoWe're doing both and know most of the backers so far - this is dogfooding OpenFaaS functions. Webhooks are a perfect use-case for functions.
- toomuchtodo 9y agoAwesome work on OpenFaaS. It serves a critical need in defending against serverless vendor lock-in.