probot / smee-client

🔴 Receives payloads then sends them to your local server
https://smee.io
ISC License
439 stars 137 forks source link

POST to Smee server fails to authenticate because of mismatched headers #50

Closed Schachte closed 6 years ago

Schachte commented 6 years ago

I have smee-client running locally and see that web-hooks are being triggered back to my bot locally, however, all requests are throwing 400's.

      { Error: cannot POST / (400)
    at Response.toError (/usr/local/lib/node_modules/smee-client/node_modules/superagent/lib/node/response.js:94:15)
    at ResponseBase._setStatusProperties (/usr/local/lib/node_modules/smee-client/node_modules/superagent/lib/response-base.js:123:16)
    at new Response (/usr/local/lib/node_modules/smee-client/node_modules/superagent/lib/node/response.js:41:8)
    at Request._emitResponse (/usr/local/lib/node_modules/smee-client/node_modules/superagent/lib/node/index.js:752:20)
    at IncomingMessage.parser (/usr/local/lib/node_modules/smee-client/node_modules/superagent/lib/node/index.js:916:38)
    at emitNone (events.js:111:20)
    at IncomingMessage.emit (events.js:208:7)
    at endReadableNT (_stream_readable.js:1055:12)
    at _combinedTickCallback (internal/process/next_tick.js:138:11)
    at process._tickCallback (internal/process/next_tick.js:180:9)
        status: 400,
        text: 'Error: signature does not match event payload and secret',
        method: 'POST',
        path: '/' },

I verified the secret in the .env matches the app secret, but still no luck. Where can I get the correct header information to get this request to go through?

Schachte commented 6 years ago

I dove a bit more into https://developer.github.com/webhooks/securing/. Looks like I could just throw the desired payload data in as the string with my token as the secret and the hash validates as the X-Hub-Signature. Events were pulled off the docs. Not sure if the GUID matters in thie case?

I used this hashing algorithm tool: https://www.freeformatter.com/hmac-generator.html#ad-output

Securing your webhooks | GitHub Developer Guide
Free Online HMAC Generator / Checker Tool (MD5, SHA-256, SHA-512) - FreeFormatter.com
This free online tool let's you compute a HMAC using your desired algorithm, for example MD5 or SHA-256 and many others