Skip to content

Update securing-your-webhooks.md #3315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 10, 2021
Merged

Update securing-your-webhooks.md #3315

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6c04104
Update securing-your-webhooks.md
kristianjaeger Jan 29, 2021
8ad11ec
Merge branch 'main' into patch-1
lucascosti Feb 10, 2021
f69d036
Move encoding note to after code example
lucascosti Feb 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion content/developers/webhooks-and-events/securing-your-webhooks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ When your secret token is set, {% data variables.product.product_name %} uses it
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "[email protected]" %}
{% note %}

**Note:** For backward-compatibility, we also include the `X-Hub-Signature` header that is generated using the SHA-1 hash function. If possible, we recommend that you use the `X-Hub-Signature-256` header for improved security. The example below demonstrate using the `X-Hub-Signature-256` header.
**Note:** For backward-compatibility, we also include the `X-Hub-Signature` header that is generated using the SHA-1 hash function. If possible, we recommend that you use the `X-Hub-Signature-256` header for improved security. The example below demonstrates using the `X-Hub-Signature-256` header.

{% endnote %}
{% endif %}
Expand Down Expand Up @@ -80,6 +80,12 @@ def verify_signature(payload_body)
end{% endif %}
```

{% note %}

**Note:** Webhook payloads can contain unicode characters. If your language and server implementation specifies a character encoding, ensure that you handle the payload as UTF-8.

{% endnote %}

Your language and server implementations may differ from this example code. However, there are a number of very important things to point out:

* No matter which implementation you use, the hash signature starts with {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "[email protected]" or "github-ae@latest" %}`sha256=`{% elsif currentVersion ver_lt "[email protected]" %}`sha1=`{% endif %}, using the key of your secret token and your payload body.
Expand Down