Return 401 for unverified webhook requests instead of 404

[tobie]

Summary

Changed the webhook request verification flow to return HTTP 401 (Unauthorized) for unverified requests in production, instead of falling through to Express's default 404 handler. This provides clearer feedback to GitHub about authentication failures.

Key Changes

• GitHub webhook endpoint (/github-hook):

  • Removed next parameter from route handler since it's no longer called
  • Added explicit res.sendStatus(401) response for unverified requests in production
  • Removed the next() call that was allowing unverified requests to fall through

• Config endpoint (/config):

  • Removed next parameter from async route handler
  • Removed unnecessary finally block that was calling next()

• Documentation (error-handling.md):

  • Updated to reflect that unverified requests now receive a 401 response instead of falling through to 404
  • Clarified that mismatched secrets will now show up as 401 in GitHub's delivery log

• Tests (test/server.js):

  • Updated test expectations from 404 to 401 for both wrong signature and missing signature scenarios

Implementation Details

The changes eliminate unnecessary use of the next() callback in Express middleware. Since these endpoints don't need to pass control to subsequent middleware, removing the next parameter and explicit calls simplifies the code. The explicit 401 response for unverified webhooks provides better HTTP semantics and clearer debugging information in GitHub's webhook delivery logs.

https://claude.ai/code/session_01Qq8TZHcEcvGppVjWSdt7ek