Class: Whatsapp::Webhook::Signature

Inherits:
Object
  • Object
show all
Defined in:
lib/ruby/whatsapp/webhook/signature.rb

Overview

Verifies the X-Hub-Signature-256 header Meta attaches to every webhook POST, an HMAC-SHA256 of the raw request body keyed by the app secret. Source: https://developers.facebook.com/documentation/business-messaging/whatsapp/webhooks/overview

Constant Summary collapse

PREFIX = 
"sha256="

Class Method Summary collapse

Class Method Details

.valid?(payload:, header:, app_secret: Whatsapp.configuration.app_secret) ⇒ Boolean

Returns Whether the header matches the computed signature.

Parameters:

  • payload (String) —

    The raw (unparsed) request body.

  • header (String, nil) —

    The X-Hub-Signature-256 header value.

  • app_secret (String, nil) (defaults to: Whatsapp.configuration.app_secret) —

    The secret to verify against. Defaults to the globally configured secret; pass an explicit value for multi-tenant apps where each account has its own Meta App (and therefore its own secret).

Returns:

  • (Boolean) —

    Whether the header matches the computed signature.



18
19
20
21
22
23
24
 
# File 'lib/ruby/whatsapp/webhook/signature.rb', line 18

def valid?(payload:, header:, app_secret: Whatsapp.configuration.app_secret)
  return false if header.nil? || header.empty?
  return false if app_secret.nil? || app_secret.empty?

  expected = PREFIX + OpenSSL::HMAC.hexdigest("SHA256", app_secret, payload)
  ActiveSupport::SecurityUtils.secure_compare(expected, header)
end