feat(webhook): verify native Asana webhook signatures (X-Hook-Signature) - #54697
Open
mguttmann wants to merge 1 commit into
Open
feat(webhook): verify native Asana webhook signatures (X-Hook-Signature)#54697mguttmann wants to merge 1 commit into
mguttmann wants to merge 1 commit into
Conversation
The generic webhook adapter recognised GitLab and a generic HMAC header, but not Asana's native signature scheme. Asana signs each delivery with `X-Hook-Signature` = hex HMAC-SHA256 over the raw request body, using the secret exchanged during the initial `X-Hook-Secret` handshake. Add explicit verification for that header so Asana webhooks can be authenticated natively (constant-time compare), instead of forcing integrators to fall back to a generic header or disable signature verification entirely.
alt-glitch
added
type/feature
Contributor
|
Thanks for adding the provider-specific comparison; the HMAC calculation itself matches the stated wire format. Problems
Suggested changes
Automated hermes-sweeper review. |
teknium1
added
sweeper:risk-security-boundary
This was referenced Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #54693.
What
Add native verification of Asana's
X-Hook-Signature(hex HMAC-SHA256 over the raw body, keyed by the handshake secret) to the webhook adapter, with a constant-time compare.Why
The adapter recognised GitLab and a generic HMAC header but not Asana's scheme, so Asana deliveries couldn't be authenticated natively — integrators had to fall back to a generic header or disable verification.
Why this is better
hmac.compare_digest) — no timing side channel.Test
python -m py_compile gateway/platforms/webhook.pypasses.X-Hook-Signatureauthenticates; an invalid one is rejected.