middleware skips signature validation when 'x-line-signature' header is not set.

[musou1500]

in middleware.ts

    const signature = req.headers["x-line-signature"] as string;

    if (!signature) {
      next();
      return;
    }

what happens if someone request without x-line-signature header?

[hatashiro]

In the case, the body will not be parsed. However, if any body parser is used after the middleware, the body will be parsed as usual and the server can be spoofed as you assumed. I think it's better to throw SignatureValidationFailed for the case.

[musou1500]

@noraesae I think so too. I wrote it (#26).