Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clarifying that X-GitHub-Delivery is unique per event, not per delivery #33184

Merged
merged 4 commits into from
May 27, 2024
Merged

Clarifying that X-GitHub-Delivery is unique per event, not per delivery #33184

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c33cedb
docs: making clarification
CBID2 May 26, 2024
e7e8ba1
Merge branch 'main' into clarifying-information
CBID2 May 26, 2024
bc27d49
Merge branch 'main' into clarifying-information
CBID2 May 27, 2024
fa7be01
Update webhook-events-and-payloads.md
nguyenalex836 May 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/webhooks/using-webhooks/best-practices-for-using-webhooks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ If your server goes down, you should redeliver missed webhooks once your server

## Use the `X-GitHub-Delivery` header

In a replay attack, a bad actor intercepts a webhook delivery and re-sends the delivery. To protect against replay attacks, you can use the `X-GitHub-Delivery` header to ensure that each delivery is unique.
In a replay attack, a bad actor intercepts a webhook delivery and re-sends the delivery. To protect against replay attacks, you can use the `X-GitHub-Delivery` header to ensure that each delivery is unique per event.

{% note %}

Expand Down
2 changes: 1 addition & 1 deletion content/webhooks/webhook-events-and-payloads.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ HTTP POST payloads that are delivered to your webhook's configured URL endpoint

- `X-GitHub-Hook-ID`: The unique identifier of the webhook.
- `X-GitHub-Event`: The name of the event that triggered the delivery.
- `X-GitHub-Delivery`: A globally unique identifier (GUID) to identify the delivery.{% ifversion ghes %}
- `X-GitHub-Delivery`: A globally unique identifier (GUID) to identify the event.{% ifversion ghes %}
- `X-GitHub-Enterprise-Version`: The version of the {% data variables.product.prodname_ghe_server %} instance that sent the HTTP POST payload.
- `X-GitHub-Enterprise-Host`: The hostname of the {% data variables.product.prodname_ghe_server %} instance that sent the HTTP POST payload.{% endif %}
- `X-Hub-Signature`: This header is sent if the webhook is configured with a `secret`. This is the HMAC hex digest of the request body, and is generated using the SHA-1 hash function and the `secret` as the HMAC `key`. `X-Hub-Signature` is provided for compatibility with existing integrations. We recommend that you use the more secure `X-Hub-Signature-256` instead.
Expand Down
Loading