From cf99e2c96d7eaf8322669ca8bb259d6b859c8c65 Mon Sep 17 00:00:00 2001 From: ANDROIDHASSAN <84630851+ANDROIDHASSAN@users.noreply.github.com> Date: Tue, 13 Oct 2026 22:39:39 +0530 Subject: [PATCH] fix(api): report a missing sha256 claim in WebhookReceiver TokenVerifier.verify() returns sha256 as "" when the claim is absent, so the `claims.sha256 is None` check never fired and such tokens were rejected with "hash mismatch" instead of "sha256 was not found in the token". --- livekit-api/livekit/api/webhook.py | 2 +- tests/api/test_webhook.py | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/livekit-api/livekit/api/webhook.py b/livekit-api/livekit/api/webhook.py index 9f500637..63839f3d 100644 --- a/livekit-api/livekit/api/webhook.py +++ b/livekit-api/livekit/api/webhook.py @@ -11,7 +11,7 @@ def __init__(self, token_verifier: TokenVerifier): def receive(self, body: str, auth_token: str) -> WebhookEvent: claims = self._verifier.verify(auth_token) - if claims.sha256 is None: + if not claims.sha256: raise Exception("sha256 was not found in the token") body_hash = hashlib.sha256(body.encode()).digest() diff --git a/tests/api/test_webhook.py b/tests/api/test_webhook.py index 3937cdba..72db710f 100644 --- a/tests/api/test_webhook.py +++ b/tests/api/test_webhook.py @@ -68,6 +68,15 @@ def test_bad_hash() -> None: receiver.receive(TEST_EVENT, jwt) +def test_missing_hash() -> None: + token_verifier = TokenVerifier(TEST_API_KEY, TEST_API_SECRET) + receiver = WebhookReceiver(token_verifier) + + jwt = AccessToken(TEST_API_KEY, TEST_API_SECRET).to_jwt() + with pytest.raises(Exception, match="sha256 was not found"): + receiver.receive(TEST_EVENT, jwt) + + def test_invalid_body() -> None: token_verifier = TokenVerifier(TEST_API_KEY, TEST_API_SECRET) receiver = WebhookReceiver(token_verifier)