Repository navigation
fix(github-webhook): configurable target; fail closed when unconfigured - #44
Merged
Merged
Conversation
- Forward target comes from GITHUB_WEBHOOK_FORWARD_URL instead of the hardcoded Tailscale IP http://100.68.100.15:3005 (apparently the upstream author's Discord bot). - Fail closed: the route returns 503 and forwards nothing unless both GITHUB_WEBHOOK_SECRET and GITHUB_WEBHOOK_FORWARD_URL are set. Before, with no secret the HMAC check was skipped and any anonymous POST was relayed to the internal target. - With both set, a valid x-hub-signature-256 is always required. - 10s timeout on the forward request. - Documented in .env.example and the README API table. 7 tests in route-hardening.test.ts; 4 fail against the previous code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/api/github-webhookforwarded every delivery to a hardcoded Tailscale IP,http://100.68.100.15:3005/github/webhook, apparently the upstream author's Discord bot. Fixing that exposed a worse problem: withGITHUB_WEBHOOK_SECRETunset, the HMAC check was skipped entirely and any anonymous POST was relayed to that internal target.Changes
GITHUB_WEBHOOK_FORWARD_URL.GITHUB_WEBHOOK_SECRETandGITHUB_WEBHOOK_FORWARD_URLare set, the route returns 503 "not configured" and forwards nothing.x-hub-signature-256(HMAC-SHA256,timingSafeEqual) is required: missing → 401, wrong → 401..env.example; README API table row updated.Tests (route-hardening.test.ts, fetch stubbed)
4 of these fail against the previous code. The 3 that pass check behaviour it already had right.
tsc0 ·eslint .0 errors ·vitest(non-DB) 66/66 ·next build✅ · no100.68.100.15left in the repo.Note for deployers
If you relied on the old behaviour, set both variables, e.g.
GITHUB_WEBHOOK_FORWARD_URL=http://<bot-host>:3005/github/webhook, and configure the same secret on the GitHub webhook.🤖 Generated with Claude Code