connect-githubhook
connect-githubhook copied to clipboard
Check the IP address of the webhook's origin
Hi Nathan,
Would you be interested in a pull request in which the middleware checks the IP address of the originating server? I think it could be good to make sure that the webhook is valid and not generated from somewhere else. The question is whether this can be used maliciously (if not checked) though I do think it could be used in a DDoS attack if you perform tasks when a new webhook is received.
I'm happy to do this for you but just wanted to check first if it's something you might want. I could always make it configurable with an option when creating the middleware to maintain backwards compatibility. :)
From the https://github.com/user/project/settings/hooks page:

Cheers, Andy