Repository navigation
fix(security): the webhook receiver answers every refusal with the same 403 - #534
Merged
Merged
Conversation
…me 403
POST /api/connectors/{id}/webhook is public, and answered 404 for an unknown
connector and 400 for one of another type before checking the secret, so an
anonymous caller could learn which connector ids exist and which are webhooks.
A missing connector, another type, a connector without a secret and a wrong
secret now all return the same 403.
Found by the separate review of #528. The parametrised test fails on the old
code for the missing and wrong-type cases.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkWPqAcWbxfqz1aCP6Qsdx
Conflicts were side-by-side additions to CHANGELOG, file-map and the docs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A follow-up from the separate security review of #528 (Info/Low).
POST /api/connectors/{connector_id}/webhookis the one public receiver: the connector id plus its mandatory secret is the credential. It answered 404 for an unknown id and 400 ("Not a webhook connector") for a connector of another type, both before checking the secret. An anonymous caller could therefore enumerate which connector ids exist and which of them are webhooks.Change
The following refusals now return one identical response,
403 {"success": false, "message": "Forbidden"}:The server-side logs still distinguish a missing secret from a bad one. Nothing changes after the secret is proven (503 when inactive, 400 for an invalid payload, 200).
Tests
test_every_refusal_before_the_secret_reads_the_same, parametrised over missing, other type and wrong secret, asserts the exact status and body. It fails on the old code for the missing and other-type cases.🤖 Generated with Claude Code
https://claude.ai/code/session_01KkWPqAcWbxfqz1aCP6Qsdx