Skip to main content

verify_webhook

Function verify_webhook 

Source
pub fn verify_webhook<K: AsRef<str>, V: AsRef<str>>(
    body: &[u8],
    headers: &[(K, V)],
    secret: &[u8],
    options: VerifyOptions,
) -> bool
Expand description

Verify a webhook delivery with replay protection.

Checks x-wi-signature-v2: t=<unix seconds>,v1=<hex>, the HMAC-SHA256 of "<t>.<body>", and rejects it when t is further than options.tolerance_seconds from now: a captured request cannot be replayed later, and a tampered timestamp fails the signature. A delivery with no v2 header (older servers) falls back to the legacy x-wi-signature body signature, which has no replay protection. A malformed v2 header is rejected, never downgraded.

headers is any list of (name, value) pairs; names match case-insensitively.