alexellis / hmac

Validate hmac signatures in Go

hmac

Validate HMAC in Golang.

Who uses it HMAC?

GitHub, Patreon and some other parties will use HMAC signing with their outgoing webhooks so that you can verify the webhook is from the expected sender.

Who uses this project?

A few of the notable dependents on this package, but there are many more:

• alexellis/derek
• openfaas/faas-cli
• openfaas/openfaas-cloud
• crossplane/tbs
• Qolzam/telar-cli
• s8sg/faas-flow

How it works:

HMAC uses a symmetric key that both sender/receiver share ahead of time. The sender will generate a hash when wanting to transmit a message - this data is sent along with the payload. The recipient will then sign payload with the shared key and if the hash matches then the payload is assumed to be from the sender.

Read more on Wikipedia

Documentation

Example:

import "github.com/alexellis/hmac"

...
var input []byte
var signature string
var secret string

valid := hmac.Validate(input, signature, secret)

fmt.Printf("Valid HMAC? %t\n")

hmac's Issues

Add support for 256 for GitHub

I believe @burtonr tried to use this library for something other than GitHub and ran into an issue with needing SHA256 or similar.

This issue should look at what other schemes are desirable for HMAC use and implement them.

• Update the unit tests with a new example as per https://github.com/alexellis/hmac/blob/master/pkg_test.go#L40 but for a sha256 prefix
• Consider whether a new signature is required such as Validate256 Sign256, a new parameter Validate(shaLength, ...) or no breaking changes