Skip to content

fix(python): normalize webhook signature hex comparison and handle case-insensitive headers - #41

Open
Adityakk9031 wants to merge 1 commit into
RightNow-AI:mainfrom
Adityakk9031:#40
Open

Adityakk9031 wants to merge 1 commit into
RightNow-AI:mainfrom
Adityakk9031:#40

Conversation

@Adityakk9031

@Adityakk9031 Adityakk9031 commented Aug 2, 2026

Copy link
Copy Markdown

close #40

Description

Fixes issue #40 in the Python SDK (runinfra):

  1. Case-Insensitive Webhook Signatures: verify_webhook_signature() generated a lowercase hex digest using hexdigest(), but compared it against incoming signatures directly with hmac.compare_digest(expected, signature). If an incoming webhook payload contained an uppercase hex signature string (e.g. v1=4F2A...), hmac.compare_digest failed due to case-sensitive character comparison. Updated to compare signature.lower() in constant time.
  2. Case-Insensitive Content-Type Header Lookup: _Speech.create used dict.get("content-type", dict.get("Content-Type", ...)). Updated to perform case-insensitive header matching across response header keys.

Testing & Verification

  • Added test_construct_webhook_event_accepts_uppercase_hex_signature to python/tests/test_runinfra_sdk.py.
  • Ran full Python unit test suite: 159/159 tests passed (Ran 159 tests in 0.975s - OK).
  • Ran node scripts/verify-version-sync.mjs: Version sync intact at 0.2.0.

@Adityakk9031

Copy link
Copy Markdown
Author

@jaberjaber23 have a look

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[bug]: Python verify_webhook_signature fails on uppercase hex signatures

1 participant