Github Verify Signature icon

Github Verify Signature

Verify the received signature with 'secret_token'

Github Verify Signature

AI-generated

Overview

This node verifies the integrity and authenticity of a payload received from GitHub by comparing a provided HMAC SHA-256 hash signature with a locally computed one using a shared secret token. It is useful in scenarios where you want to ensure that webhook payloads from GitHub have not been tampered with and are genuinely from GitHub. For example, it can be used in automation workflows to validate incoming webhook events before processing them further.

Use Case Examples

  1. Validating GitHub webhook payloads to ensure they are from GitHub and have not been altered.
  2. Securing automation workflows by verifying the signature of incoming webhook data before triggering actions.

Properties

Name Meaning
Hash Signature (256) The HMAC SHA-256 hash signature received from GitHub in the 'X-Hub-Signature-256' header, used to verify the payload's authenticity.
Secret token The shared secret token between GitHub and the node, used to compute the HMAC hash for verification.
Payload/Body The raw payload or body content received from GitHub, which is used to compute the HMAC hash for comparison.

Output

JSON

  • hmac - The computed HMAC SHA-256 hash of the payload using the secret token.
  • verified - Boolean indicating whether the computed HMAC matches the provided signature, confirming payload authenticity.

Dependencies

  • Node.js 'crypto' module for HMAC SHA-256 hashing.

Troubleshooting

  • If the node always outputs verification as false, check that the secret token matches exactly the one configured in GitHub webhook settings.
  • Ensure the payload/body string is exactly the same as received from GitHub without any modifications or encoding changes.
  • Verify that the signature string includes the 'sha256=' prefix as expected from GitHub's 'X-Hub-Signature-256' header.

Links

Discussion