Configuration mistake, misconception about trigger rules or bug? about webhook HOT 8 CLOSED

It looks like it's working as intended. You're asking webhook to match a URL parameter that either doesn't exist or is invalid. The command should not be triggered in either case.

from webhook.

Yes, that was not what I meant. The hook does not execute when the wrong token is sent, but webhook also does tell you how the token should be. A not so secret secret if you will.

In other words, you can't really use payload-hash-sha1 for authentication.

from webhook.

@fbartels, webhook uses your secret to calculate a HMAC SHA1 of the payload. It's not showing you the secret. If this was unclear, maybe you can suggest an improvement to the documentation or help us to make it more clear to new users.

from webhook.

No, but its showing you the sha1. And when you call ?token=sha1-of-token, then your call will succeed.

from webhook.

Unless I'm mistaken, it's not showing the sha1 to the remote agent. It's only logging it on the server side.

from webhook.

You are correct. It leaks out the calculated SHA1 of the payload that it's expecting, this is a bug, no idea how this slipped out unnoticed!

from webhook.

Hi Adnan,

thanks for the fix. I did a manual checkout and build of 2.4.0 and can confirm that I cannot reproduce the issue anymore.

from webhook.

👍 thanks for reporting:)

from webhook.