Page MenuHomePhabricator
Differential D13756

[keyserver] verify webhook event with webhook secret
ClosedPublic
Actions

Authored by will on Oct 20 2024, 10:03 PM.
Tags
None
Referenced Files
F3381047: D13756.id.diff
Thu, Nov 28, 3:52 AM
Unknown Object (File)
Mon, Nov 25, 8:31 AM
Unknown Object (File)
Mon, Nov 25, 6:46 AM
Unknown Object (File)
Sat, Nov 23, 4:35 AM
Unknown Object (File)
Wed, Nov 20, 12:47 PM
Unknown Object (File)
Wed, Nov 20, 8:29 AM
Unknown Object (File)
Wed, Nov 20, 8:29 AM
Unknown Object (File)
Fri, Nov 15, 5:12 PM
View All 35 Files
Subscribers
tomek

Details

Reviewers
ashoat
varun
Commits
rCOMM7166879e117a: [keyserver] verify webhook event with webhook secret
Summary

This verifies the webhook event with X-Neynar-Signature and the webhook secret to verify it's coming from Neynar.

Depends on D13755

Test Plan

Tested by triggering a webhook event on warpcast and verifying that isValid was true.
Verified that a webhook event with a differing body resulted in isValid evaluating as false

Diff Detail

Repository
rCOMM Comm
Lint
No Lint Coverage
Unit
No Test Coverage

Event Timeline

will created this revision.Oct 20 2024, 10:03 PM
Herald added a subscriber: tomek. · View Herald TranscriptOct 20 2024, 10:03 PM
Harbormaster completed remote builds in B32312: Diff 45286.Oct 20 2024, 10:22 PM
will requested review of this revision.Oct 20 2024, 10:22 PM
ashoat accepted this revision.Oct 21 2024, 8:57 AM
ashoat added inline comments.
keyserver/src/responders/farcaster-webhook-responders.js
16

Nit

20

How about signature, to match naming below

34

Nit: don't know if we need the isValid variable... I would just inline the check on line 35

You could probably even inline signature === hmac.digest('hex') directly, to be honest

This revision is now accepted and ready to land.Oct 21 2024, 8:57 AM
will added a child revision: D13762: [lib] implement fetchFarcasterCastByHash for neynar client.Oct 21 2024, 1:40 PM
will updated this revision to Diff 45412.Oct 28 2024, 1:51 PM

feedback

will marked 3 inline comments as done.Oct 28 2024, 1:52 PM
Harbormaster completed remote builds in B32390: Diff 45412.Oct 28 2024, 2:08 PM
will mentioned this in D13775: [keyserver] add community creation logic to farcaster webhook responder.Oct 29 2024, 4:50 PM
will added inline comments.Wed, Oct 30, 1:34 PM
keyserver/src/responders/farcaster-webhook-responders.js
16

Addressed in latest rebase

20

Changed to signature

34

I inlined it in the function but also introduced a isValidSignature

will updated this revision to Diff 45489.Wed, Oct 30, 1:40 PM

rebase

Harbormaster completed remote builds in B32456: Diff 45489.Wed, Oct 30, 2:27 PM
Closed by commit rCOMM7166879e117a: [keyserver] verify webhook event with webhook secret (authored by will). · Explain WhyThu, Oct 31, 12:18 PM
This revision was automatically updated to reflect the committed changes.
will added a commit: rCOMM7166879e117a: [keyserver] verify webhook event with webhook secret.

Revision Contents
Changeset List

PathSize
keyserver/
src/
responders/
32 lines

Diff 45286

View Options

keyserver/src/responders/farcaster-webhook-responders.js

Loading...