Merge pull request nodejs#17 from nodejs-github-bot/debug-invalid-secret

phillipj · phillipj · commit 1535116c051d · 2016-04-10T23:23:36.000+02:00
Log when we've got requests with invalid secrets
diff --git a/lib/github-events.js b/lib/github-events.js
@@ -19,6 +19,7 @@ module.exports = (app) => {
     const signature = req.headers['x-hub-signature']
     if (!signature || signature !== sign(secret, req.raw)) {
       res.writeHead(401, 'Invalid Signature')
+      console.error('! event@%s: %s - invalid signature, returning 401', source, data.action)
       return res.end()
     }
 

Original file line number	Diff line number	Diff line change
`@@ -19,6 +19,7 @@ module.exports = (app) => {`
`19`	`19`	`const signature = req.headers['x-hub-signature']`
`20`	`20`	`if (!signature \|\| signature !== sign(secret, req.raw)) {`
`21`	`21`	`res.writeHead(401, 'Invalid Signature')`
	`22`	`+ console.error('! event@%s: %s - invalid signature, returning 401', source, data.action)`
`22`	`23`	`return res.end()`
`23`	`24`	`}`
`24`	`25`