Dev.to
techCenter
The trailing newline that broke every webhook signature.translating…
1 min readUSAForem (DEV Community)
I spent an evening convinced GitHub was sending broken webhook signatures. It wasn't. echo was.
The setup
Chngd's GitHub Marketplace webhook verifies every inbound event with HMAC-SHA256, comparing GitHub's X-Hub-Signature-256 header against a signature computed from the raw…