Struct SignatureValidator 

pub struct SignatureValidator { /* private fields */ }

Validates GitHub webhook signatures using HMAC-SHA256.

This validator ensures webhook payloads are authentic by verifying the X-Hub-Signature-256 header against the payload using the webhook secret.

Security

• Uses constant-time comparison to prevent timing attacks
• Never logs secrets or signature values
• Validates signature format before HMAC computation
• Completes validation in under 100ms

Examples

use github_bot_sdk::webhook::SignatureValidator;
use github_bot_sdk::auth::SecretProvider;
use std::sync::Arc;

let validator = SignatureValidator::new(secret_provider);

let payload = b"{\"action\":\"opened\",\"number\":1}";
let signature = "sha256=a1b2c3d4...";  // From X-Hub-Signature-256 header

if validator.validate(payload, signature).await? {
    println!("Valid webhook");
} else {
    println!("Invalid signature - rejecting webhook");
}

Implementations

impl SignatureValidator

pub fn new(secrets: Arc<dyn SecretProvider>) -> Self

Create a new signature validator.

Arguments

• secrets - Provider for retrieving webhook secrets

Examples

let validator = SignatureValidator::new(secret_provider);

pub async fn validate( &self, payload: &[u8], signature: &str, ) -> Result<bool, ValidationError>

Validate a webhook signature.

Verifies that the signature matches the HMAC-SHA256 of the payload using the webhook secret. Uses constant-time comparison to prevent timing attacks.

Arguments

• payload - The raw webhook payload bytes
• signature - The signature from X-Hub-Signature-256 header (format: “sha256=<hex>”)

Returns

• Ok(true) - Signature is valid
• Ok(false) - Signature is invalid (tampered payload or wrong secret)
• Err - Validation error (malformed signature, secret retrieval failure)

Examples

let payload = b"{\"action\":\"opened\"}";
let signature = "sha256=5c4a...";

match validator.validate(payload, signature).await {
    Ok(true) => println!("Valid webhook"),
    Ok(false) => println!("Invalid signature"),
    Err(e) => println!("Validation error: {}", e),
}

Trait Implementations

impl Clone for SignatureValidator

fn clone(&self) -> SignatureValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignatureValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.