robstenbom / node-github-digest

Minimalistic package to validate the integrity of incoming GitHub webhooks with zero dependencies.

Validate GitHub webhook signatures

Minimalistic package to validate the integrity of incoming GitHub webhooks with zero dependencies.

Usage

// initialize with the secret
const secret = process.env.GITHUB_SECRET;
const { validate, sign } = require('github-digest')(secret);

// Validating:
if (!validate(req)) {
  res.status(400);
  return res.json({ message: 'Unauthorized' });
}

// You can also sign your own requests (useful for integration testing)
const payload = { body: { hello: 'world' } };
assert.ok(validate(sign(payload))); // => ok

Tests

$ npm run test