This repository has been archived by the owner on Feb 24, 2020. It is now read-only.
Releases: thermondo/closeio
Releases · thermondo/closeio
1.5.2
1.5.1
1.5.0
Add utilities to verify signed webhooks.
- You can use
closio.contrib.django.utils.webhook_signature_valid
to verify webhook requests that you receive.
When a webhook subscription is created via the Closeio API you get a secret signature key in the response of the request. This is the key that Closeio uses to sign their webhooks. You can use the key to verify that the request is indeed coming from Closeio (only Closeio should have the signature key) and that the payload was not altered inbetween. This is a simple security mechanism to protect you from false requests to your endpoints that receive the webhooks. The signature key for each webhook subscription needs to be stored inside the settingCLOSEIO_WEBHOOK_SIGNATURE_KEYS
as json string containing the webhook subscription ID as key and the signature key as value, e.g.:More information can be found in the Closeio's documentation.CLOSEIO_WEBHOOK_SIGNATURE_KEYS = '{"whsub_1": "123", "whsub_2": "456"}'
- You can use the pytest fixture
sign_closeio_webhook_request
to sign your requests for testing purposes. Usage example:data = {'some key': 'some value'} data, headers = _sign_request(data) client.post('/my/url/', data, **headers)
1.4.1
Add created_by
and date_created
to testing stub for notes creation.