Include a VerifySignature() method

[daamsie]

When listening for Mailgun webhooks, it's important to verify the signature. It would be nice to have this available in this component.

See here a c# implementation

Happy to create a PR if you want to include it.

I'd add an extra parameter to the init function - webhookSigningKey

Then create a new method verifySignature() that handles the verification, throwing an error if the webhookSigningKey is not set.

[mjclemente]

Might make sense to add - is there a section in their docs covering this?

[daamsie]

Yeah, it's in the Webhooks section of the docs. My implementation below:

Changing init to add webhookSigningKey

public any function init( required string secretApiKey, required string publicApiKey, string domain = "", string baseUrl = "https://api.mailgun.net/v3", boolean forceTestMode = false, numeric httpTimeout = 60, boolean includeRaw = true, string webhookSigningKey = "" ) {

    structAppend( variables, arguments );
    return this;
  }

Added a verifySignature function

public boolean function verifySignature( required any timestamp, required string token, required string signature ) {
  if ( variables.webhookSigningKey eq "" ) {
    throw("Mailgun needs to be initialised with your Webhook Signing Key");
  }

  var timestampAndToken = timestamp & token;
  var computedSignature = hmac(timestampAndToken, variables.webhookSigningKey, "HMACSHA256", "us-ascii")

  return computedSignature eq signature;
}

Feel free to use / adjust or I can post a PR.

[mjclemente]

Looks good to me. PR welcome!

Can you be sure to include the documentation for it in the README as well?

[daamsie]

Done. I did update the README with info but was a little unsure on how to explain the optional nature of the extra argument in init. I left it out of the Coldbox explanation in the interest of brevity. But maybe it makes more sense to include all the arguments in that example for both of them.

Also, though I did add the code to ModuleConfig and it is simple enough that I'm confident it's accurate - I didn't test this part because I'm not a Coldbox user.

[mjclemente]

Resolved with your PR #11

Thanks!