The highest tagged major version is
Documentation
¶
Overview ¶
Package webhook signs and verifies webhook payloads with an HMAC-SHA256 scheme: the signature header is "t=<unix>,v1=<hex>" where the MAC is computed over "<unix>.<payload>". The timestamp enables replay protection.
Index ¶
Examples ¶
Constants ¶
const ( // DefaultHeader is the conventional signature header name. DefaultHeader = "Webhook-Signature" // DefaultTolerance is the default allowed clock skew for the timestamp. DefaultTolerance = 5 * time.Minute )
Variables ¶
var ( // ErrMalformedHeader means the signature header could not be parsed. ErrMalformedHeader = errors.New("webhook: malformed signature header") // ErrExpired means the signature timestamp is outside the tolerance window. ErrExpired = errors.New("webhook: signature timestamp outside tolerance") // ErrInvalidSignature means the signature did not match the payload. ErrInvalidSignature = errors.New("webhook: signature mismatch") )
Functions ¶
func Middleware ¶
func Middleware(cfg MiddlewareConfig) fiber.Handler
Middleware verifies the signature header on the request body before calling the next handler. On failure it returns a 401 via apierror (rendered by the bootstrap ErrorHandler). It does not reveal which check failed.
func Verify ¶
Verify checks header against payload using secret. If tolerance > 0, the timestamp must be within tolerance of now. Returns nil when valid, otherwise ErrMalformedHeader, ErrExpired, or ErrInvalidSignature.
Example ¶
Sign a payload, then verify it with the same secret.
package main
import (
"fmt"
"time"
"github.com/rahmadafandi/fibr/webhook"
)
func main() {
secret := "whsec_example"
payload := []byte(`{"event":"ok"}`)
header := webhook.Sign(payload, secret, time.Now())
err := webhook.Verify(payload, header, secret, webhook.DefaultTolerance)
fmt.Println("valid:", err == nil)
}
Output: valid: true
Types ¶
type MiddlewareConfig ¶
type MiddlewareConfig struct {
Secret string // required shared secret
Header string // signature header name; defaults to DefaultHeader
Tolerance time.Duration // allowed clock skew; defaults to DefaultTolerance
}
MiddlewareConfig configures the inbound-webhook verification middleware.
Source Files