diff --git a/doc/usage/using_webhooks.rst b/doc/usage/using_webhooks.rst index f138a40..9f2e5d5 100644 --- a/doc/usage/using_webhooks.rst +++ b/doc/usage/using_webhooks.rst @@ -12,22 +12,19 @@ There is, in the settings page, a web-hook key which is used by the server (here pagure) to sign the message sent and which you can use to ensure the notifications received are coming from the right source. -Each POST request made contains two specific headers: +Each POST request made contains some specific headers: :: - X-Pagure-Topic + X-Pagure + X-Pagure-Project X-Pagure-Signature X-Pagure-Signature-256 + X-Pagure-Topic +``X-Pagure`` contains URL of the pagure instance sending this notification. -``X-Pagure-Topic`` is a global header giving a clue about the type of action -that just occurred. For example ``issue.edit``. - -.. warning:: This header is present for convenience only, it is not - signed and therefore should not be trusted. Rely on the payload - after checking the signature to make any decision. - +``X-Pagure-Project`` contains the name of the project on that pagure instance. ``X-Pagure-Signature`` contains the signature of the message allowing to check that the message comes from pagure. @@ -39,6 +36,14 @@ allowing to check that the message comes from pagure. was actually sent by the correct Pagure instance. These are not included in the signed data. +``X-Pagure-Topic`` is a global header giving a clue about the type of action +that just occurred. For example ``issue.edit``. + +.. warning:: The headers ``X-Pagure``, ``X-Pagure-Project`` and ``X-Pagure-Topic`` + are present for convenience only, they are not signed and therefore + should not be trusted. Rely on the payload after checking the + signature to make any decision. + Pagure relies on ``hmac`` to sign the content of its messages. If you want to validate the message, in python, you can do something like the following: diff --git a/webhook-server/pagure-webhook-server.py b/webhook-server/pagure-webhook-server.py index 0be6126..51d3788 100644 --- a/webhook-server/pagure-webhook-server.py +++ b/webhook-server/pagure-webhook-server.py @@ -60,6 +60,8 @@ def call_web_hooks(project, topic, msg): year = datetime.datetime.now().year if isinstance(topic, six.text_type): topic = to_bytes(topic, encoding='utf8', nonstring="passthru") + msg['pagure_instance'] = pagure.APP.config['APP_URL'] + msg['project_fullname'] = project.fullname msg = dict( topic=topic.decode('utf-8'), msg=msg, @@ -74,9 +76,11 @@ def call_web_hooks(project, topic, msg): hashhex256 = hmac.new( str(project.hook_token), content, hashlib.sha256).hexdigest() headers = { - 'X-Pagure-Topic': topic, + 'X-Pagure': pagure.APP.config['APP_URL'], + 'X-Pagure-project': project.fullname, 'X-Pagure-Signature': hashhex, - 'X-Pagure-Signature-256': hashhex256 + 'X-Pagure-Signature-256': hashhex256, + 'X-Pagure-Topic': topic, } msg = json.dumps(msg) for url in project.settings.get('Web-hooks').split('\n'):