[kroqdotdev]

Summary

Security fix for the released Python SDK. decode_standard_webhook_secret turned a secret of whsec_ alone, or only whitespace, into a zero-length HMAC key. An HMAC keyed with nothing is one anyone can compute, so the following accepted forged signatures with such a secret:

• verify_signature("standard-webhooks" | "clerk" | "resend", ...);
• verify_forwarded_email, verify_forwarded_request and verify_relayed_request.

I confirmed it against 0.1.1. The realistic way to hit it is a secret read from an empty environment variable or file, for example "whsec_" + os.environ.get(...).

• An empty key now raises ValueError before any verdict, in verification and in request building alike. This matches the TypeScript SDK, where WebCrypto refuses a zero-length key.
• Version 0.1.2: pyproject.toml, __version__, uv.lock, PYTHON_SDK_VERSION, and a Python track entry.

An independent review of the Go port (#539) found the bug; that PR has the same fix.

Release

Merge, wait for main's CI, then tag sdk-python-v0.1.2.

Test plan

• tests/test_empty_key.py covers:
  • four empty secrets across the three providers;
  • the three forwarding checks;
  • signing;
  • a real secret that still verifies.
• uv run pytest (607 passed), ruff check, ruff format --check, mypy
• lib/changelog.test.ts

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c38e313c-6e36-46ce-bed8-16e023a2ad53

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[kroqdotdev]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[kroqdotdev]

CodeRabbit is rate-limited, so a separate review agent reviewed this PR instead.

Verdict: correct, with no blocking problems.

• Coverage: every path that builds a key from such a secret goes through the shared helper. That covers Standard Webhooks, Clerk and Resend, the three forwarding checks, and template signing.
• No other way in: no caller can still get True, or a WebhookVerificationError that hides the misuse, for an empty key. No secret other than one that is empty or only ASCII whitespace decodes to an empty key.
• The tests: 19 of the 20 new tests fail on the old code.
• The version: 0.1.2 is set consistently everywhere.

One gap closed in 6129da1: the tests always sent complete, fresh headers, so nothing would catch the forwarding check losing its early key check, and with it the empty key would be hidden behind missing_headers or timestamp_out_of_range. New cases with no headers and with a stale timestamp fail without that check. The same test on the Go port (#539) found that RelayedRequest there checked headers first; that is fixed in a627f78.

Noted for later: TypeScript only refuses the key when it imports it, after the header checks. Python and Go now refuse it earlier, which is stricter. Making TypeScript throw early, with a conformance vector for it, is on the follow-up list.