Repository navigation
Implement SignatureVerificationError #34
Description
Raised by Webhook.construct_event() when the HMAC-SHA256 signature in the Shade-Signature header does not match the computed signature for the payload. Should include the expected vs received values (masked) to aid debugging.
Proposed Steps:
- Define
SignatureVerificationError(ShadeError)inerrors.py. - Add
header: str(received) and a hint about what went wrong (wrong secret, tampered payload). - Do not expose the expected signature value in the exception to avoid leaking secrets.
Acceptance Criteria:
- A mismatched signature raises
SignatureVerificationError. - The exception message explains possible causes (wrong secret, payload modified in transit).
- The full expected HMAC is never included in the exception message.
Activity
GBOYEE commentedon Jul 20, 2026
Hey, I'd like to help with this. I can handle this one. I'll fix it and add a test to lock it down. I can put up a PR for this once claimed.
Tijesunimi004 commentedon Jul 23, 2026
I have experience with Open SOurce and would like to work on this issue Maintainer
grantfox-oss commentedon Jul 23, 2026
🦊 GrantFox — @Tijesunimi004 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!
Next steps:
Closes #34)Good luck! Track your progress on GrantFox.
grantfox-oss commentedon Jul 24, 2026
🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!
@Tijesunimi004's PR #48 was approved and merged by @codebestia.
🏆 @Tijesunimi004: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (624 total points). Track your full progress on GrantFox.
👏 Great work, @Tijesunimi004! Keep contributing to ShadeProtocol.