Webhook Secret
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start by reading GitHub's webhook security documentation linked in the issue, then locate the Elixir/Phoenix application's webhook POST handler. Determine how the handler can validate GitHub's Webhook Secret before accepting issue edits; done means spoofed requests are rejected while genuine GitHub webhooks continue to work.
Written by the indexing model from the issue text.
Description
When creating a New GitHub Application via https://github.com/settings/apps/new
we are given the option to add a Webhook Secret:
While the Webhook Secret is "optional", I feel it would add good "security layer" to our app.
Otherwise anyone can "spoof" a webhook POST request to our app and make an "edit" to someone else's issue.
Yes, this would be "non-destructive" because the "single-source-of-truth" is still GitHub.
But if the person made multiple "malicious" edits they could create quite a lot of spam/noise.
I don't think we need to do this "urgently" while we are using the app internally,
but as soon as it's public we should consider adding this layer of protection.
How would this work in our Elixir/Phoenix App?
The ruby code in the docs: https://developer.github.com/webhooks/securing
should be fairly easy to "translate" to Elixir.
- Dominant language
- Elixir
- Stars
- 33
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from dwyl/github-backup
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 15/100
dwyl/github-backup#138 ·
-
discuss enhancement priority-2
dwyl/github-backup#136 · 10 comments · 1 assignee ·
-
😕 Openhelp wanted priority-2
Difficulty 5/5 Over a week Newbie friendliness 25/100
dwyl/github-backup#135 · 1 comment · 3 reactions ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 20/100
dwyl/github-backup#133 ·
-
discuss priority-4 technical
Difficulty 5/5 Over a week Newbie friendliness 20/100
dwyl/github-backup#132 · 3 comments · 1 reaction ·
All issues in dwyl/github-backup
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
phoenixframework/phoenix#6847 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
beyond-all-reason/teiserver#1584 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ash-project/ash#2954 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
membraneframework/boombox#149 ·