search

getsentry / sentry

Developer-first error tracking and performance monitoring
https://sentry.io
Other
37.69k stars 4.05k forks source link

Webhook signature verification fails #71025

Open quintasda opened 2 months ago

quintasda commented 2 months ago

Environment

SaaS (https://sentry.io/)

Steps to Reproduce

Verify the Signature

Customer case

Expected Result

The signature matches

Actual Result

The signature doesn't match in ~10% of the messages

Product Area

Settings - Integrations

Link

No response

DSN

No response

Version

No response

getsantry[bot] commented 2 months ago

Assigning to @getsentry/support for routing ⏲️

getsantry[bot] commented 2 months ago

Routing to @getsentry/product-owners-settings-integrations for triage ⏲️

Dhrumil-Sentry commented 2 months ago

Thanks for this report, we will investigate this cc @sentaur-athena

sentaur-athena commented 2 months ago

This issue is fixed now. We investigated and the reason was a new json serializer we started using since May 9. We reverted the changes to the previous serializer and looking at dashboards the 400 and 401 responses are eliminated.

sentaur-athena commented 1 month ago

@quintasda as we're adding back the new serializer wanted to make sure we're not breaking customer's experience. Can you please provide me with code snippet of how you're validating signature?

You mentioned Verify the Signature from our docs but I was wondering if you're using the python or js example? Also what you use to dump json.