Deno support is undocumented about webhooks-methods.js

[surprisetalk]

Alright, here's a working example of GitHub signature verification for Deno:

import { Buffer } from "https://deno.land/std/io/mod.ts";
import { timingSafeEqual } from "https://deno.land/std/node/crypto.ts";
import { hmac } from "https://deno.land/x/[email protected]/mod.ts";

const encoder = new TextEncoder()

const signature = req.headers.get(`x-hub-signature`) ?? ``;
const signatureBuffer = encoder.encode(signature);

const payload = await req.body({ type: `text` }).value;

const algorithm = signature.startsWith("sha256=") ? "sha256" : "sha1";

const verification = `${algorithm}=${hmac(algorithm, "helloworld", payload, "utf8", "hex")}`;
const verificationBuffer = encoder.encode(verification);

// constant time comparison to prevent timing attachs
// https://stackoverflow.com/a/31096242/206879
// https://en.wikipedia.org/wiki/Timing_attack
const matchesSignature = signatureBuffer.length === verificationBuffer.length
  && await timingSafeEqual(signatureBuffer, verificationBuffer);

[roj1512]

I accidentally clicked on 'bug'. The bug label might not be accurate.

[surprisetalk]

I'm experiencing the same problem with both X-Hub-Signature and X-Hub-Signature-256.

[roj1512]

I already made it working with https://stackoverflow.com/a/71088170/10379728.