3 ms·
It's not. It should be verifying the signature in the X-Patreon-Signature header (which should match the body signed with the webhook secret iirc).
by notamy 9y ago
It's not. It should be verifying the signature in the X-Patreon-Signature header (which should match the body signed with the webhook secret iirc).
- alexellisuk 9y agoYes you can perform HMAC validation - here's an example of HMAC in Ruby and Go - https://blog.alexellis.io/swarm-secrets-in-action/ https://blog.alexellis.io/swarm-secrets-in-action/ - https://github.com/openfaas/faas-cli/blob/master/sample/github_hmac/handler.go https://github.com/openfaas/faas-cli/blob/master/sample/gith... This is how I'm validating HMAC in Python for the backers code - https://github.com/openfaas/backer-thankyou/blob/master/patreon-responder/validate.py https://github.com/openfaas/backer-thankyou/blob/master/patr...
- notamy 9y agoAh, my bad, I completely missed that >_<