From 233925a05bbbd71e98c74c7b4c802485a7a650a9 Mon Sep 17 00:00:00 2001 From: Richard McDaniel Date: Thu, 26 Jun 2025 15:58:37 -0500 Subject: [PATCH] Cast to string for signature token comparison --- src/Auth/SignatureAuthenticator.php | 4 ++-- src/Auth/TokenAuthenticator.php | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/Auth/SignatureAuthenticator.php b/src/Auth/SignatureAuthenticator.php index f878fa0..5b0deaf 100644 --- a/src/Auth/SignatureAuthenticator.php +++ b/src/Auth/SignatureAuthenticator.php @@ -11,8 +11,8 @@ class SignatureAuthenticator implements WebhookAuthenticator public function validate(Request $request): Request { if (! hash_equals( - $request->header(config('workflows.webhook_auth.signature.header')) ?? '', - hash_hmac('sha256', $request->getContent(), config('workflows.webhook_auth.signature.secret')) + (string) $request->header(config('workflows.webhook_auth.signature.header')), + (string) hash_hmac('sha256', $request->getContent(), config('workflows.webhook_auth.signature.secret')) )) { abort(401, 'Unauthorized'); } diff --git a/src/Auth/TokenAuthenticator.php b/src/Auth/TokenAuthenticator.php index 64d552f..caa50a0 100644 --- a/src/Auth/TokenAuthenticator.php +++ b/src/Auth/TokenAuthenticator.php @@ -10,8 +10,9 @@ class TokenAuthenticator implements WebhookAuthenticator { public function validate(Request $request): Request { - if ($request->header(config('workflows.webhook_auth.token.header')) !== config( - 'workflows.webhook_auth.token.token' + if (! hash_equals( + (string) config('workflows.webhook_auth.token.token'), + (string) $request->header(config('workflows.webhook_auth.token.header')) )) { abort(401, 'Unauthorized'); } pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy