PR#2189: Have the web-hook use the signed content and have a content-type header -

pagure

#2189 Have the web-hook use the signed content and have a content-type header

Merged Mar 28, 2017 by pingou. Opened Mar 27, 2017 by pingou.

fix_webhook into master

no initial comment

puiterwijk commented Mar 27, 2017

+1 on the code, but for the record: this breaks every existing Pagure webhook payload user.

pingou commented Mar 27, 2017

We looked through the current user of web-hooks on pagure.io and per our record, it seems no one of the 7 people using web-hooks are validating the signature.

There may be people using pagure outside of pagure.io that would be impacted, but seeing the absence of bug report on how the web-hook server performs versus its documentation, we feel reasonably confident that they do not.

I will wait the last minute to merge this PR into 2.14.1 in case someone disagrees with it.

Edited Mar 27, 2017 by pingou

puiterwijk commented Mar 28, 2017

For implementors: do note that you can distinguish between the old and new behavior using the Content-Type header.

rebased

Mar 28, 2017

Pull-Request has been merged by pingou

Mar 28, 2017

Metadata

Assignee

None

Tags

No Tags

pagure

#2189 Have the web-hook use the signed content and have a content-type header Merged Mar 28, 2017 by pingou. Opened Mar 27, 2017 by pingou. fix_webhook into master

Metadata

#2189 Have the web-hook use the signed content and have a content-type header

Merged Mar 28, 2017 by pingou. Opened Mar 27, 2017 by pingou.

fix_webhook into master