feat(bot): add signature verification logging
- Added info-level logging to provide details about signature verification, including secret length and partial hashes for expected and received signatures. - Helps in debugging signature mismatches without exposing full sensitive data.
This commit is contained in:
parent
d5967cf392
commit
33937ab115
1 changed files with 5 additions and 3 deletions
|
|
@ -61,17 +61,19 @@ def verify_signature(body: bytes, signature: str) -> bool:
|
|||
if not BOT_SECRET:
|
||||
log.warning("No bot secret configured, skipping signature verification")
|
||||
return True
|
||||
|
||||
|
||||
expected = hmac.new(
|
||||
BOT_SECRET.encode(),
|
||||
body,
|
||||
hashlib.sha256
|
||||
).hexdigest()
|
||||
|
||||
|
||||
# Nextcloud sends: sha256=<hex>
|
||||
if signature.startswith("sha256="):
|
||||
signature = signature[7:]
|
||||
|
||||
|
||||
log.info(f"Signature verification: secret_len={len(BOT_SECRET)}, expected={expected[:16]}..., received={signature[:16]}...")
|
||||
|
||||
return hmac.compare_digest(expected, signature)
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue