Skip to content

Commit 98303c8

Browse files
authored
Update example to follow HMAC best practice (#5753)
* Update example to follow HMAC best practice - Using `hmac.compare_digest()` mitigates [timing-based attacks](https://en.wikipedia.org/wiki/Timing_attack) on the signature verification. - Updated the line to pull the signature header value to use the `.get()` method in order to avoid a `KeyError` exception.
1 parent 2361e69 commit 98303c8

File tree

1 file changed

+4
-2
lines changed
  • src/docs/product/integrations/integration-platform

1 file changed

+4
-2
lines changed

src/docs/product/integrations/integration-platform/webhooks.mdx

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ import hashlib
6565
import hmac
6666
import json
6767

68-
expected_digest = request.headers['sentry-hook-signature']
68+
expected_digest = request.headers.get('sentry-hook-signature') # returns None if header is missing
6969
body = json.dumps(request.body)
7070

7171
digest = hmac.new(
@@ -74,8 +74,10 @@ digest = hmac.new(
7474
digestmod=hashlib.sha256,
7575
).hexdigest()
7676

77+
if not expected_digest: # The signature is missing
78+
raise UnauthorizedError
7779

78-
if digest != expected_digest:
80+
if not hmac.compare_digest(digest, expected_digest):
7981
raise UnauthorizedError
8082
```
8183

0 commit comments

Comments
 (0)