Page MenuHomePhabricator
Differential D13756

[keyserver] verify webhook event with webhook secret
ClosedPublic
Actions

Authored by will on Oct 20 2024, 10:03 PM.
Tags
None
Referenced Files
F3529158: D13756.id45412.diff
Tue, Dec 24, 3:50 PM
F3528781: D13756.id45551.diff
Tue, Dec 24, 10:19 AM
F3526251: D13756.id45489.diff
Mon, Dec 23, 9:15 PM
Unknown Object (File)
Sat, Dec 14, 3:13 AM
Unknown Object (File)
Sun, Dec 1, 8:05 AM
Unknown Object (File)
Thu, Nov 28, 11:19 PM
Unknown Object (File)
Thu, Nov 28, 9:22 PM
Unknown Object (File)
Thu, Nov 28, 3:52 AM
View All 42 Files
Subscribers
tomek

Details

Reviewers
ashoat
varun
Commits
rCOMM7166879e117a: [keyserver] verify webhook event with webhook secret
Summary

This verifies the webhook event with X-Neynar-Signature and the webhook secret to verify it's coming from Neynar.

Depends on D13755

Test Plan

Tested by triggering a webhook event on warpcast and verifying that isValid was true.
Verified that a webhook event with a differing body resulted in isValid evaluating as false

Diff Detail

Repository
rCOMM Comm
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

will created this revision.Oct 20 2024, 10:03 PM
Herald added a subscriber: tomek. · View Herald TranscriptOct 20 2024, 10:03 PM
Harbormaster completed remote builds in B32312: Diff 45286.Oct 20 2024, 10:22 PM
will requested review of this revision.Oct 20 2024, 10:22 PM
ashoat accepted this revision.Oct 21 2024, 8:57 AM
ashoat added inline comments.
keyserver/src/responders/farcaster-webhook-responders.js
16 ↗(On Diff #45286)

Nit

20 ↗(On Diff #45286)

How about signature, to match naming below

34 ↗(On Diff #45286)

Nit: don't know if we need the isValid variable... I would just inline the check on line 35

You could probably even inline signature === hmac.digest('hex') directly, to be honest

This revision is now accepted and ready to land.Oct 21 2024, 8:57 AM
will added a child revision: D13762: [lib] implement fetchFarcasterCastByHash for neynar client.Oct 21 2024, 1:40 PM
will updated this revision to Diff 45412.Oct 28 2024, 1:51 PM

feedback

will marked 3 inline comments as done.Oct 28 2024, 1:52 PM
Harbormaster completed remote builds in B32390: Diff 45412.Oct 28 2024, 2:08 PM
will mentioned this in D13775: [keyserver] add community creation logic to farcaster webhook responder.Oct 29 2024, 4:50 PM
will added inline comments.Oct 30 2024, 1:34 PM
keyserver/src/responders/farcaster-webhook-responders.js
16 ↗(On Diff #45286)

Addressed in latest rebase

20 ↗(On Diff #45286)

Changed to signature

34 ↗(On Diff #45286)

I inlined it in the function but also introduced a isValidSignature

will updated this revision to Diff 45489.Oct 30 2024, 1:40 PM

rebase

Harbormaster completed remote builds in B32456: Diff 45489.Oct 30 2024, 2:27 PM
Closed by commit rCOMM7166879e117a: [keyserver] verify webhook event with webhook secret (authored by will). · Explain WhyOct 31 2024, 12:18 PM
This revision was automatically updated to reflect the committed changes.
will added a commit: rCOMM7166879e117a: [keyserver] verify webhook event with webhook secret.

Revision Contents
Changeset List

PathSize
keyserver/
src/
responders/
39 lines

Diff 45551

View Options

keyserver/src/responders/farcaster-webhook-responders.js

Loading...