Forgejo webhook deliveries are all rejected (invalid signature) #31

New issue

Closed

opened 2026-11-01 13:19:49 +00:00 by Gilles · 0 comments

Gilles commented

2026-11-01 13:19:49 +00:00

Owner

Every delivery to /api/webhooks/forgejo/issues/<repo>/ is refused with 403 « missing or invalid signature » (seen in prod on Filao/backend, Filao/frontend-app, Filao/frontend-web since their hooks were registered on 2026-11-01). So a Spec: CODE line in a new issue never creates a link, and state changes only arrive through the 15-minute poll.

Cause: apps.specs.forgejo.ensure_webhook sends the secret as a top-level "secret" of the create-hook payload. Forgejo only reads it from config["secret"] and ignores the top-level key, so the hook has no secret and the HMAC never matches ForgejoRepoWebhook.secret (the unverified point noted on #28).

Fix:

put the secret in config;
a resend_forgejo_webhooks management command that re-sends each registered hook's config (URL + secret), to repair the hooks already registered.

Every delivery to `/api/webhooks/forgejo/issues/<repo>/` is refused with 403 « missing or invalid signature » (seen in prod on Filao/backend, Filao/frontend-app, Filao/frontend-web since their hooks were registered on 2026-11-01). So a `Spec: CODE` line in a new issue never creates a link, and state changes only arrive through the 15-minute poll. Cause: `apps.specs.forgejo.ensure_webhook` sends the secret as a top-level `"secret"` of the create-hook payload. Forgejo only reads it from `config["secret"]` and ignores the top-level key, so the hook has no secret and the HMAC never matches `ForgejoRepoWebhook.secret` (the unverified point noted on #28). Fix: - put the secret in `config`; - a `resend_forgejo_webhooks` management command that re-sends each registered hook's config (URL + secret), to repair the hooks already registered.

Gilles added the

bug

label

2026-11-01 13:19:49 +00:00

Gilles referenced this issue from a pull request that will close it,

2026-11-01 13:20:01 +00:00

fix: send the Forgejo webhook secret inside the hook config #32

Gilles referenced this issue from a commit

2026-11-01 13:20:02 +00:00

fix: send the Forgejo webhook secret inside the hook config

Gilles closed this issue

2026-11-01 13:51:17 +00:00