GitHub-WebHook
GitHub-WebHook copied to clipboard
Remove ValidateIPAddress and recommend using ValidateHubSignature
I don't really like having a hardcoded IP range in sourcecode, it could possibly change as well.
GitHub appears to agree. They seem to view validating with the key as an alternative to IP white-listing. From GitHub's (Securing your webhooks)[https://developer.github.com/webhooks/securing/]:
There are a few ways to go about this–for example, you could opt to whitelist requests from GitHub’s IP address–but a far easier method is to set up a secret token and validate the information.