search

adnanh / webhook

webhook is a lightweight incoming webhook server to run shell commands
MIT License
10.25k stars 823 forks source link

Bitbucket now supports webhook secrets 🥳 #662

Open peterwwillis opened 10 months ago

peterwwillis commented 10 months ago

Bitbucket have finally decided to support secrets for webhooks: https://bitbucket.org/blog/enhanced-webhook-security

I'm not sure if there's code that needs updating, but these docs on Bitbucket could probably use updating: https://github.com/adnanh/webhook/blob/master/docs/Hook-Examples.md#incoming-bitbucket-webhook

Confusing matters is the fact that Bitbucket's X-Hub-Signature header is using a SHA256 hash, whereas both GitHub's and Facebook's X-Hub-Signature is SHA1, while their header X-Hub-Signature-256 is SHA256. You'd think after six years they'd want parity with other vendors... but better incompatible than unavailable, I guess 😐

adnanh commented 10 months ago

Better late than never, I guess 😄