GitHub Webhooks

const crypto = require('crypto');

app.post('/webhooks/github', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-hub-signature-256'];
  const hmac = crypto.createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET);
  const digest = 'sha256=' + hmac.update(req.body).digest('hex');
  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(digest))) {
    return res.status(400).send('Invalid signature');
  }
  const event = req.headers['x-github-event'];
  const payload = JSON.parse(req.body);
  // Handle event here
  res.json({ received: true });
});

import hmac, hashlib, os
from flask import Flask, request

app = Flask(__name__)

@app.route('/webhooks/github', methods=['POST'])
def github_webhook():
    sig = request.headers.get('X-Hub-Signature-256', '')
    digest = 'sha256=' + hmac.new(
        os.environ['GITHUB_WEBHOOK_SECRET'].encode(),
        request.get_data(), hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(sig, digest):
        return 'Invalid signature', 400
    event = request.headers.get('X-GitHub-Event')
    # Handle event here
    return '', 200

import "crypto/hmac"
import "crypto/sha256"

func verifyGitHub(body []byte, signature, secret string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(body)
    expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signature), []byte(expected))
}