Skip to content

Incorrect assumption of tokens to be invalidated in webhoook endpoints #23

@AwesomeStickz

Description

@AwesomeStickz

When the bot tries to send a request to a webhook (seems to be any webhook endpoints but I've only checked the ones in interaction response page) with an invalid webhook token, it receives a 401 status with additional body:

{
    "message": "Invalid Webhook Token",
    "code": 50027
}

However, nirn just sees the 401 and assumes that the token is invalid and prevents sending further requests to any endpoint using the same token, this would lead to downtime until nirn is restarted.

Here's a sample screenshot from postman for the PATCH /webhooks/{application.id}/{interaction.token}/messages/@original route:

Image

Proposed solution:

Nirn should check for the 50027 code and ignore it / block future requests to only the webhook token rather than the bot token

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions