webhook

package

v0.20.0 Latest Latest Go to latest Published: Oct 17, 2026 License: MIT Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/AlexGalhardo/vukem

Links

Open Source Insights

Documentation ¶

Overview ¶

Package webhook verifies signed incoming webhooks (HMAC-SHA256 over the raw body), the scheme used by GitHub, Shopify, Resend/Svix-style providers and your own integrations.

r.Post("/webhooks/github", handle).Use(webhook.Middleware("X-Hub-Signature-256", secret, 1<<20))

Index ¶

Variables
func Middleware(header string, secret []byte, maxBody int64) func(http.Handler) http.Handler
func Sign(secret, payload []byte) string
func VerifyHMAC(secret, payload []byte, signature string) bool

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrSignature = &errs.HTTPError{Status: http.StatusUnauthorized, Message: "Invalid webhook signature."}

ErrSignature is the 401 answered for missing or wrong signatures.

Functions ¶

func Middleware ¶

func Middleware(header string, secret []byte, maxBody int64) func(http.Handler) http.Handler

Middleware verifies the signature in header against the raw body (at most maxBody bytes) and restores the body for the handler. Failures get 401 and a "webhook.signature_invalid" security event.

func Sign ¶

func Sign(secret, payload []byte) string

Sign returns the hex HMAC-SHA256 of payload (for tests and outgoing webhooks).

func VerifyHMAC ¶

func VerifyHMAC(secret, payload []byte, signature string) bool

VerifyHMAC reports whether signature is the HMAC-SHA256 of payload with secret. The signature may be hex or base64 and may carry a "sha256=" prefix. The comparison is constant time.

Types ¶

This section is empty.

Source Files ¶

View all Source files

webhook.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL