Module: Printavo::Webhooks

Defined in:
lib/printavo/webhooks.rb

Class Method Summary collapse

Class Method Details

.verify(signature, payload, secret) ⇒ Boolean

Verifies a Printavo webhook signature using HMAC-SHA256.

Uses a constant-time comparison to prevent timing attacks.

Examples:

Rails controller

if Printavo::Webhooks.verify(
     request.headers["X-Printavo-Signature"],
     request.raw_post,
     ENV["PRINTAVO_WEBHOOK_SECRET"]
   )
  # process event
else
  head :unauthorized
end

Parameters:

  • signature (String) —

    the signature from the X-Printavo-Signature header

  • payload (String) —

    the raw request body string

  • secret (String) —

    your webhook secret configured in Printavo

Returns:

  • (Boolean) 


27
28
29
30
31
32
33
34
 
# File 'lib/printavo/webhooks.rb', line 27

def self.verify(signature, payload, secret)
  return false if signature.nil? || payload.nil? || secret.nil?

  expected = OpenSSL::HMAC.hexdigest('SHA256', secret, payload)
  OpenSSL.secure_compare(expected, signature)
rescue ArgumentError, TypeError
  false
end