Webhook Secret
- Ngôn ngữ chính
- Elixir
- Star
- 33
- Fork
- 3
- Chỉ số merge pull request
- Không có pull request nào được merge trong 30 ngày
Mô tả
When creating a New GitHub Application via https://github.com/settings/apps/new
we are given the _option_ to add a `Webhook Secret`:
While the `Webhook Secret` is "_optional_", I feel it would add good "security layer" to our app.
Otherwise _anyone_ can "spoof" a webhook `POST` request to our app and make an "edit" to someone else's issue.
> Yes, this would be "non-destructive" because the "single-source-of-truth" is still _GitHub_.
But if the person made _multiple_ "malicious" edits they could create quite a lot of spam/noise.
I don't think we need to do this "urgently" while we are using the app _internally_,
but as soon as it's `public` we should consider adding this layer of protection.
How would this work in our Elixir/Phoenix App?
The `ruby` code in the docs: https://developer.github.com/webhooks/securing
should be _fairly_ easy to "translate" to Elixir.
Hướng dẫn đóng góp
Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này
Đánh giá
Issue này chưa được đánh giá.