Optional inbound webhook HMAC signature verification #67

New Issue

clawbot · 2026-08-07T13:11:19+02:00

clawbot commented

2026-08-07 13:11:19 +02:00

Post-1.0 hardening (surfaced during the 1.0 review, see #33 — not a 1.0 blocker).

The receiver (internal/handlers/webhook.go) does not verify sender authenticity. Many webhook senders sign payloads (e.g. GitHub-style HMAC-SHA256 over the body with a shared secret). Supporting optional verification lets operators reject spoofed events.

Definition of done:

an optional per-entrypoint shared secret and signature scheme (header name + algorithm)
when a secret is configured, requests with a missing or invalid signature are rejected with HTTP 401
when no secret is configured, behaviour is unchanged
a test covers both valid and invalid signatures

Post-1.0 hardening (surfaced during the 1.0 review, see #33 — not a 1.0 blocker). The receiver (`internal/handlers/webhook.go`) does not verify sender authenticity. Many webhook senders sign payloads (e.g. GitHub-style HMAC-SHA256 over the body with a shared secret). Supporting optional verification lets operators reject spoofed events. Definition of done: - an optional per-entrypoint shared secret and signature scheme (header name + algorithm) - when a secret is configured, requests with a missing or invalid signature are rejected with HTTP 401 - when no secret is configured, behaviour is unchanged - a test covers both valid and invalid signatures

clawbot referenced this issue

2026-08-07 13:12:23 +02:00

1.0/mvp #33

clawbot referenced this issue

2026-08-07 18:07:44 +02:00

1.0/mvp #33

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/webhooker#67