Skip to content

Signing key hex assumption can crash with non-hex keys #1

Description

@jmarbutt

Problem

The out-of-band registration code assumes the signing key suffix is hex-encoded and calls Convert.FromHexString(). Any non-hex signing key will throw a FormatException before registration completes.

Location: Inngest/InngestClient.cs:942-955

var keyBytes = Convert.FromHexString(normalizedKey);  // Throws if not valid hex

Expected Behavior

The SDK should either:

  1. Handle non-hex keys gracefully (encode as UTF-8 bytes instead)
  2. Validate the key format and return a clear error (401/500) instead of throwing

SDK Spec Reference

The spec only requires hashing the key bytes - it doesn't mandate hex encoding. We should verify what format Inngest actually sends keys in.

Priority

High - this could crash production applications during registration.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions