Allow to skip signature verification #741

habara-k · 2025-09-19T09:19:51Z

Changes

Allow skipping signature verification for webhooks

Motivation

The signature returned with webhooks is calculated using a single channel secret. If the bot owner changes their channel secret, the signature for webhooks starts being calculated using the new channel secret. To avoid signature verification failures, the bot owner must update the channel secret on their server, which is used for signature verification. However, if there is a timing mismatch in the update—and such a mismatch is almost unavoidable—verification will fail during that period.

In such cases, having an option to skip signature verification for webhooks would be a convenient way to avoid these issues.

This reverts commit e276dfc.

…v4

…v4

eucyt · 2025-10-03T03:07:21Z

src/parser/lib/EventRequestOptions.php

+     *                    This can be useful in scenarios such as when you're in the process of updating
+     *                    the channel secret and need to temporarily bypass verification to avoid disruptions.
+     */
+    public $skipSignatureValidation;


Are you using a callable instead of a bool so that the user can dynamically skip validation? If so, it might be helpful to mention that briefly in the PHPDoc.

eucyt · 2025-10-03T03:09:31Z

src/parser/lib/EventRequestOptions.php

+class EventRequestOptions
+{
+    /**
+     * @var callable|null Function that returns boolean to determine if signature validation should be skipped.


It might be a good idea to explicitly specify that it returns a bool.

Suggested change

* @var callable|null Function that returns boolean to determine if signature validation should be skipped.

* @var callable(): bool|null Function that returns boolean to determine if signature validation should be skipped.

Thank you for the suggestion!
Yes, the intention is to allow dynamic control — the callable can return a boolean value to determine whether signature validation should be skipped.

However, we had to simplify the PHPDoc type to callable|null instead of callable(): bool|null, because phpDocumentor 3.x currently doesn’t support the newer callable syntax with return types.
To avoid breaking the documentation build, we decided to keep the simpler type declaration.

https://docs.phpdoc.org/guide/references/phpdoc/types.html#:~:text=null%3B%0A%7D-,callable,-the%20element%20to

It says it's available from version 3.3.0, so is that not correct? We use 3.3.1

line-bot-sdk-php/.github/workflows/generate-code.yml

Line 56 in a227e57

wget https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.3.1/phpDocumentor.phar

and more, this is probably (callable(): bool)|null ...?

or null|callable(): bool?

eucyt · 2025-10-03T03:09:46Z

src/parser/lib/EventRequestOptions.php

+    /**
+     * Constructor
+     *
+     * @param callable|null $skipSignatureValidation Function that returns boolean to determine if signature validation should be skipped


ditto

Suggested change

* @param callable|null $skipSignatureValidation Function that returns boolean to determine if signature validation should be skipped

* @param callable(): bool|null $skipSignatureValidation Function that returns boolean to determine if signature validation should be skipped

Yang-33 · 2025-10-03T09:05:18Z

.github/workflows/generate-code.yml

          echo "DIFF_IS_EMPTY=$([[ -z "$diff_excluding_submodule" ]] && echo 'true' || echo 'false')" >> $GITHUB_ENV
          echo "CURRENT_DATETIME=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
+
+      # Save full diff to file and upload artifact


I recognize this as a workaround, but do you encounter a diff when executing the steps written in the workflow locally?

line-bot-sdk-php/.github/workflows/generate-code.yml

Lines 33 to 57 in e6a1849

# Install openapi-generator-cli

- run: echo "OPENAPI_GENERATOR_VERSION=7.11.0" >> $GITHUB_ENV

- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4

id: openapi-generator-cache

env:

cache-name: openapi-generator-cache

with:

path: ~/bin/openapitools

key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.OPENAPI_GENERATOR_VERSION }}

- if: steps.openapi-generator-cache.outputs.cache-hit != 'true'

run: |

mkdir -p ~/bin/openapitools

curl https://raw.githubusercontent.com/OpenAPITools/openapi-generator/master/bin/utils/openapi-generator-cli.sh > ~/bin/openapitools/openapi-generator-cli

chmod u+x ~/bin/openapitools/openapi-generator-cli

export PATH=$PATH:~/bin/openapitools/

OPENAPI_GENERATOR_VERSION=${{ env.OPENAPI_GENERATOR_VERSION }} openapi-generator-cli version

- name: Generate codes

run: |

export PATH=$PATH:~/bin/openapitools/

bash tools/gen-oas-client.sh

- name: Update document

run: |

wget https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.3.1/phpDocumentor.phar

php phpDocumentor.phar run -d src -t docs

If so, this might confuse external contributors too like you, and we should consider measures to ensure stricter version control. For example, https://github.com/line/line-bot-sdk-php/blob/master/CONTRIBUTING.md should be updated.

.... However, since CI provides stable results, could it be that your local version is misaligned...?
@eucyt might help you when you're confused with something.

It seems the PHP version I was running locally was outdated. The issue is now resolved, but I plan to keep this change for future troubleshooting.

Yang-33

we're waiting response! #741 (comment)

Allow to skip signature verification

e276dfc

habara-k force-pushed the allow-to-skip-signature-verification branch from 43a6658 to e276dfc Compare September 19, 2025 09:34

habara-k added 10 commits September 22, 2025 15:24

Revert "Allow to skip signature verification"

ef4debb

This reverts commit e276dfc.

Add option to skip signature verification

96eea77

Add detailed comments

0a74854

Fix copyright

a0e8622

Generate docs

a6670ef

Add space after FUNCTION keyword

a61c9ae

Remove white space

3eed778

Remove white space

418446d

Dump diff.patch

8cba5de

Apply dumped diff.patch

b3983c6

habara-k force-pushed the allow-to-skip-signature-verification branch from d79e580 to 47bd3ec Compare September 25, 2025 02:31

Pin actions/upload-artifact to a specific commit SHA instead of using @…

e6a1849

…v4

habara-k force-pushed the allow-to-skip-signature-verification branch from 47bd3ec to e6a1849 Compare September 25, 2025 02:33

habara-k requested a review from a team September 25, 2025 02:44

eucyt reviewed Oct 3, 2025

View reviewed changes

Yang-33 reviewed Oct 3, 2025

View reviewed changes

habara-k self-assigned this Oct 7, 2025

habara-k added 2 commits October 8, 2025 11:19

Fix doc

9fddd97

Update docs

3715834

habara-k requested review from Yang-33 and eucyt October 8, 2025 02:34

Yang-33 reviewed Oct 9, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Allow to skip signature verification #741

Allow to skip signature verification #741

Uh oh!

habara-k commented Sep 19, 2025

Uh oh!

eucyt Oct 3, 2025

Uh oh!

eucyt Oct 3, 2025

Uh oh!

habara-k Oct 8, 2025

Uh oh!

Yang-33 Oct 8, 2025

Uh oh!

Yang-33 Oct 8, 2025

Uh oh!

Yang-33 Oct 8, 2025

Uh oh!

eucyt Oct 3, 2025

Uh oh!

Yang-33 Oct 3, 2025

Uh oh!

habara-k Oct 8, 2025

Uh oh!

Yang-33 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	* @var callable\|null Function that returns boolean to determine if signature validation should be skipped.
	* @var callable(): bool\|null Function that returns boolean to determine if signature validation should be skipped.

	* @param callable\|null $skipSignatureValidation Function that returns boolean to determine if signature validation should be skipped
	* @param callable(): bool\|null $skipSignatureValidation Function that returns boolean to determine if signature validation should be skipped

	# Install openapi-generator-cli
	- run: echo "OPENAPI_GENERATOR_VERSION=7.11.0" >> $GITHUB_ENV
	- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
	id: openapi-generator-cache
	env:
	cache-name: openapi-generator-cache
	with:
	path: ~/bin/openapitools
	key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.OPENAPI_GENERATOR_VERSION }}
	- if: steps.openapi-generator-cache.outputs.cache-hit != 'true'
	run: \|
	mkdir -p ~/bin/openapitools
	curl https://raw.githubusercontent.com/OpenAPITools/openapi-generator/master/bin/utils/openapi-generator-cli.sh > ~/bin/openapitools/openapi-generator-cli
	chmod u+x ~/bin/openapitools/openapi-generator-cli
	export PATH=$PATH:~/bin/openapitools/
	OPENAPI_GENERATOR_VERSION=${{ env.OPENAPI_GENERATOR_VERSION }} openapi-generator-cli version

	- name: Generate codes
	run: \|
	export PATH=$PATH:~/bin/openapitools/
	bash tools/gen-oas-client.sh
	- name: Update document
	run: \|
	wget https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.3.1/phpDocumentor.phar
	php phpDocumentor.phar run -d src -t docs

Allow to skip signature verification #741

Are you sure you want to change the base?

Allow to skip signature verification #741

Uh oh!

Conversation

habara-k commented Sep 19, 2025

Changes

Motivation

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Yang-33 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants