Skip to main content

verify_github_signature

rust_web_server::webhook

Function verify_github_signature 

Source 
pub fn verify_github_signature(
    body: &[u8],
    secret: &[u8],
    header_value: &str,
) -> bool
Available on crate feature webhook only.
Expand description

Verifies a GitHub webhook’s X-Hub-Signature-256 header value — "sha256=<hex-encoded-hmac-sha256-of-body>", keyed by the webhook’s configured secret.

GitHub also sends the older X-Hub-Signature header (HMAC-SHA1) for backward compatibility. This function deliberately does not support it — SHA-1 is cryptographically broken, this crate has no SHA-1 dependency, and GitHub recommends X-Hub-Signature-256 for all new integrations.