Webhook Secret issue

simon · August 20, 2023, 3:58pm

Have a look at how the WP Discourse plugin handles the secret:

discourse/wp-discourse/blob/e2657990a3fd8e8f0076850418b184d19e1576dc/lib/plugin-utilities.php#L654-L669


      
          		// The X-Discourse-Event-Signature consists of 'sha256=' . hamc of raw payload.
          		// It is generated by computing `hash_hmac( 'sha256', $payload, $secret )`.
          		$sig = substr( $data->get_header( 'X-Discourse-Event-Signature' ), 7 );
          		if ( $sig ) {
          			$payload = $data->get_body();
          			// Key used for verifying the request - a matching key needs to be set on the Discourse webhook.
          			$secret = ! empty( $options['webhook-secret'] ) ? $options['webhook-secret'] : '';
          
          			if ( ! $secret ) {
          
          				return new \WP_Error( 'discourse_webhook_configuration_error', 'The webhook secret key has not been set.' );
          			}
          
          			if ( hash_hmac( 'sha256', $payload, $secret ) === $sig ) {
          
          				return $data;

Topic		Replies	Views
Webhooks feedback dev	34	10301	March 21, 2017
Discourse signing parameters in webhooks feature	1	940	November 26, 2019
Chat webhook possible bug - delegated, but webhook is nil bug chat	4	347	August 18, 2023
Add new webhooks and customize webhook payload developers how-to	13	6604	July 19, 2022
Configure webhooks that trigger on Discourse events to integrate with external services admins how-to	1	46493	March 13, 2024

Webhook Secret issue

Related Topics