mirror of
https://github.com/adnanh/webhook.git
synced 2025-05-30 01:02:29 +00:00
Transition payload hash option names to hmac
The payload-hash-* options are imprecisely named. Clarify their function as HMAC validations by renaming them. The existing options will continue to work but are deprecated. Log a warning if the old options are used. All tests, examples, and documentation are updated. Fixes #289
This commit is contained in:
parent
6797bf7cf7
commit
6bbf14f7d9
11 changed files with 47 additions and 28 deletions
|
@ -46,7 +46,7 @@ This page is still work in progress. Feel free to contribute!
|
|||
{
|
||||
"match":
|
||||
{
|
||||
"type": "payload-hash-sha1",
|
||||
"type": "payload-hmac-sha1",
|
||||
"secret": "mysecret",
|
||||
"parameter":
|
||||
{
|
||||
|
@ -166,7 +166,7 @@ Values in the request body can be accessed in the command or to the match rule b
|
|||
{
|
||||
"match":
|
||||
{
|
||||
"type": "payload-hash-sha256",
|
||||
"type": "payload-hmac-sha256",
|
||||
"secret": "mysecret",
|
||||
"parameter":
|
||||
{
|
||||
|
|
|
@ -9,9 +9,9 @@
|
|||
* [Match](#match)
|
||||
* [Match value](#match-value)
|
||||
* [Match regex](#match-regex)
|
||||
* [Match payload-hash-sha1](#match-payload-hash-sha1)
|
||||
* [Match payload-hash-sha256](#match-payload-hash-sha256)
|
||||
* [Match payload-hash-sha512](#match-payload-hash-sha512)
|
||||
* [Match payload-hmac-sha1](#match-payload-hmac-sha1)
|
||||
* [Match payload-hmac-sha256](#match-payload-hmac-sha256)
|
||||
* [Match payload-hmac-sha512](#match-payload-hmac-sha512)
|
||||
* [Match Whitelisted IP range](#match-whitelisted-ip-range)
|
||||
* [Match scalr-signature](#match-scalr-signature)
|
||||
|
||||
|
@ -110,7 +110,7 @@
|
|||
"source": "header",
|
||||
"name": "X-Hub-Signature"
|
||||
},
|
||||
"type": "payload-hash-sha1",
|
||||
"type": "payload-hmac-sha1",
|
||||
"secret": "mysecret"
|
||||
}
|
||||
},
|
||||
|
@ -150,9 +150,7 @@
|
|||
|
||||
*Please note:* Due to technical reasons, _number_ and _boolean_ values in the _match rule_ must be wrapped around with a pair of quotes.
|
||||
|
||||
There are three different match rules:
|
||||
|
||||
### 1. Match value
|
||||
### Match value
|
||||
```json
|
||||
{
|
||||
"match":
|
||||
|
@ -168,7 +166,7 @@ There are three different match rules:
|
|||
}
|
||||
```
|
||||
|
||||
### 2. Match regex
|
||||
### Match regex
|
||||
For the regex syntax, check out <http://golang.org/pkg/regexp/syntax/>
|
||||
```json
|
||||
{
|
||||
|
@ -185,12 +183,13 @@ For the regex syntax, check out <http://golang.org/pkg/regexp/syntax/>
|
|||
}
|
||||
```
|
||||
|
||||
### 3. Match payload-hash-sha1
|
||||
### Match payload-hmac-sha1
|
||||
Validate the HMAC of the payload using the SHA1 hash and the given *secret*.
|
||||
```json
|
||||
{
|
||||
"match":
|
||||
{
|
||||
"type": "payload-hash-sha1",
|
||||
"type": "payload-hmac-sha1",
|
||||
"secret": "yoursecret",
|
||||
"parameter":
|
||||
{
|
||||
|
@ -208,12 +207,13 @@ will be tried unless a match is found. For example:
|
|||
X-Hub-Signature: sha1=the-first-signature,sha1=the-second-signature
|
||||
```
|
||||
|
||||
### 4. Match payload-hash-sha256
|
||||
### Match payload-hmac-sha256
|
||||
Validate the HMAC of the payload using the SHA256 hash and the given *secret*.
|
||||
```json
|
||||
{
|
||||
"match":
|
||||
{
|
||||
"type": "payload-hash-sha256",
|
||||
"type": "payload-hmac-sha256",
|
||||
"secret": "yoursecret",
|
||||
"parameter":
|
||||
{
|
||||
|
@ -231,12 +231,13 @@ will be tried unless a match is found. For example:
|
|||
X-Hub-Signature: sha256=the-first-signature,sha256=the-second-signature
|
||||
```
|
||||
|
||||
### 5. Match payload-hash-sha512
|
||||
### Match payload-hmac-sha512
|
||||
Validate the HMAC of the payload using the SHA512 hash and the given *secret*.
|
||||
```json
|
||||
{
|
||||
"match":
|
||||
{
|
||||
"type": "payload-hash-sha512",
|
||||
"type": "payload-hmac-sha512",
|
||||
"secret": "yoursecret",
|
||||
"parameter":
|
||||
{
|
||||
|
@ -254,7 +255,7 @@ will be tried unless a match is found. For example:
|
|||
X-Hub-Signature: sha512=the-first-signature,sha512=the-second-signature
|
||||
```
|
||||
|
||||
### 6. Match Whitelisted IP range
|
||||
### Match Whitelisted IP range
|
||||
|
||||
The IP can be IPv4- or IPv6-formatted, using [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_blocks). To match a single IP address only, use `/32`.
|
||||
|
||||
|
@ -268,7 +269,7 @@ The IP can be IPv4- or IPv6-formatted, using [CIDR notation](https://en.wikipedi
|
|||
}
|
||||
```
|
||||
|
||||
### 7. Match scalr-signature
|
||||
### Match scalr-signature
|
||||
|
||||
The trigger rule checks the scalr signature and also checks that the request was signed less than 5 minutes before it was received.
|
||||
A unqiue signing key is generated for each webhook endpoint URL you register in Scalr.
|
||||
|
|
|
@ -6,7 +6,7 @@ In additional to the [built-in Go template functions and features][tt], `webhook
|
|||
|
||||
## Example Usage
|
||||
|
||||
In the example `hooks.json` file below, the `payload-hash-sha1` matching rule looks up the secret hash from the environment using the `getenv` template function.
|
||||
In the example `hooks.json` file below, the `payload-hmac-sha1` matching rule looks up the HMAC secret from the environment using the `getenv` template function.
|
||||
Additionally, the result is piped through the built-in Go template function `js` to ensure that the result is a well-formed Javascript/JSON string.
|
||||
|
||||
```
|
||||
|
@ -44,7 +44,7 @@ Additionally, the result is piped through the built-in Go template function `js`
|
|||
{
|
||||
"match":
|
||||
{
|
||||
"type": "payload-hash-sha1",
|
||||
"type": "payload-hmac-sha1",
|
||||
"secret": "{{ getenv "XXXTEST_SECRET" | js }}",
|
||||
"parameter":
|
||||
{
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue