Servant combinators for writing secure GitHub webhooks
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
src/Servant/GitHub
test
.gitignore
.travis.yml
CONTRIBUTING.md
ChangeLog.md
LICENSE
README.md
Setup.hs
servant-github-webhook.cabal
stack.yaml

README.md

servant-github-webhook

Build Status Hackage servant-github-webhook servant-github-webhook

This library facilitates writing Servant routes that can safely act as GitHub webhooks.

Features:

  • Dispatching to routes based on the type of repository event.
  • Automatic verification of request signatures.
  • Route protection expressed in the type system, so webhook routes and regular routes cannot be confused.

Why use servant-github-webhook?

A webhook server needs to be publicly hosted. How can legitimate requests sent by GitHub be distinguished from (malicious) requests sent by other clients?

When a webhook is configured on a repository, a secret key is added. This key is used by GitHub to compute a signature of the request body that it sends; this signature is included in the request headers. The routing combinators in servant-github-webhook compute the signature of the received request body using the same key, and check that the signature in the request headers matches. If it does, then the request is legitimate.