Neti Pot Manufacturer

    x-hub-signature

    1.4.0 • Public • Published

    X-Hub-Signature tools for Node.js and Express

    Build Status Dependency Status Download Status Sponsor on GitHub

    X-Hub-Signature is a compact way to validate real-time updates, such as webhooks from Facebook and GitHub.

    Requires Node.js 10+

    Getting Started

    To install:

    npm install x-hub-signature --save

    Express Middleware

    To validate incoming webhooks signed with X-Hub-Signature, use the bundled Express middleware.

    const webhookMiddleware = require('x-hub-signature').middleware;
    app.use(webhookMiddleware({
      algorithm: 'sha1',
      secret: 'secret',
      require: true,
      getRawBody: req => req.rawBody
    }));

    Options:

    • algorithm (required) - sha1 or other desired signing algorithm
    • secret (required) - signing secret that the webhook was signed with
    • require (optional) - boolean, whether to require the presence of the X-Hub-Signature header. If true, throws an HTTP 400 error if the header is not present. If false, the middleware will pass the request on if the header is not present, and validate the header only if it is present. (default: true)
    • getRawBody (optional) - function that accepts req as the first argument and returns the raw body. If you use the bundled body-parser verifier (see below), you don't need to set this option.
    • header (optional) - the default header is X-Hub-Signature. For sha256, the header needs to be X-Hub-Signature-256.

    Use with body-parser

    A very common case is to have body-parser middleware globally defined. This produces complications for the x-hub-signature middleware, since it needs a copy of the raw unparsed body, and body-parser by default does not save this on the request.

    In this case, you can use the bundled middleware.extractRawBody verifier function with body-parser. This will set a reference to the buffered raw (unparsed) body to req.rawBody:

    const bodyParser = require('body-parser');
    const webhookMiddleware = require('x-hub-signature').middleware;
    app.use(bodyParser.json({
      verify: webhookMiddleware.extractRawBody
    }))
    app.use(webhookMiddleware({
      algorithm: 'sha1',
      secret: 'secret',
      require: true
    }));

    Signature API

    Use the bundled signature generator to sign a request body buffer.

    const { signer } = require('x-hub-signature');
    const sign = signer({ algorithm: 'sha1', secret: 'my_little_secret' });
    const signature = sign(new Buffer('random-signature-body'));
    // sha1=3dca279e731c97c38e3019a075dee9ebbd0a99f0

    Options:

    • algorithm (required) - sha1 or other desired signing algorithm
    • secret (required) - signing secret that the webhook was signed with

    License

    MIT License

    Acknowledgements

    This project was based on express-x-hub by Alex Curtis.

    Install

    npm i x-hub-signature

    DownloadsWeekly Downloads

    363

    Version

    1.4.0

    License

    MIT

    Unpacked Size

    14.4 kB

    Total Files

    13

    Last publish

    Collaborators

    • compwright