Repository navigation
Support restricted keys with webhook signing secrets - #25
Draft
heinrich-paystack wants to merge 1 commit into
Draft
heinrich-paystack wants to merge 1 commit into
heinrich-paystack wants to merge 1 commit into
Conversation
Add test and live "Webhook Signing Secret" settings and verify the Paystack-Signature header with them. The X-Paystack-Signature check is kept for sk_ keys, so existing setups keep working. A restricted key (rk_) cannot verify X-Paystack-Signature, so it needs the signing secret. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds support for restricted keys (
rk_) and webhook signing secrets.A restricted key cannot verify
X-Paystack-Signature, which is signed with the secret key. This adds Test and Live "Webhook Signing Secret" settings and verifies the newerPaystack-Signatureheader with the secret for the mode the event was sent in. Forms that keep using a secret key need no change.To use a restricted key:
rk_test_...orrk_live_...key into the Secret Key field. The plugin sends it as a Bearer token exactly like a secret key.whsec_...value into the new Webhook Signing Secret field for that mode.Webhook check order:
Paystack-Signature: verify it (HMAC-SHA512 with the signing secret over<t>.<raw body>, anyv1entry may match, timestamps older than 5 minutes are rejected). The result is final.sk_) and the request hasX-Paystack-Signature: the existing check, unchanged.There is no key-format check in the settings, so
rk_keys are already accepted.Testing:
php tests/run.phpon PHP 7.2 and 8.2, 150 passed, 0 failed. New cases cover the signature vector, the 5-minute window, key rotation, malformed headers, each branch of the order above, andget_webhook_eventpicking the secret for the event's mode. The new cases fail against the previous code. Not tested in a live Gravity Forms install.🤖 Generated with Claude Code