Tuesday, 14 March 2017

HMAC Signature doesn't match x-hub-signature from github

I'm handling an incoming Webhook from github, and wants to verify the x-hub-signature. I'm using hmacto hash the "secret", and then compares the two hashes. The problem is that they never match. This is my setup:

router.route("/auth")

.post((req, res) => {

    var hmac = crypto.createHmac("sha1", process.env.WEBHOOK_SECRET);
    var calculatedSignature = "sha1=" + hmac.update(JSON.stringify(req.body)).digest("hex");
    console.log(req.headers["x-hub-signature"] === calculatedSignature); // Returns false
    console.log(req.headers["x-hub-signature"]) // => sha1=blablabla
    console.log(calculatedSignature) // => sha1=foofoofoo

    res.end();
});

I've tried everything, but can't make it work. Wondering if the hmac.update() should hold another parameter than JSON.stringify(req.body). Does anyone know why they won't match?



via Jesper

No comments:

Post a Comment