Module: Praxicraft::Webhooks

Defined in:
lib/praxicraft/webhooks.rb

Class Method Summary collapse

Class Method Details

.verify_signature(secret, body, header_sig) ⇒ Object

Verify an X-Praxicraft-Signature header (sha256= or legacy bare hex). body may be nil (treated as empty payload).



11
12
13
14
15
16
17
18
19
20
21
22
23
 
# File 'lib/praxicraft/webhooks.rb', line 11

def verify_signature(secret, body, header_sig)
  return false if secret.nil? || secret.empty? || header_sig.nil? || header_sig.empty?

  payload = body.nil? ? "" : body.to_s
  digest = OpenSSL::HMAC.hexdigest("SHA256", secret, payload)
  expected = "sha256=#{digest}"

  if header_sig.start_with?("sha256=")
    secure_compare(expected, header_sig)
  else
    secure_compare(digest, header_sig) || secure_compare(expected, header_sig)
  end
end