Merge pull request #19 from amiranagram/fix-gh-header

[Fix] GitHub signature header
hotmeteor · Feb 21, 2023 · 864708c · 864708c
2 parents 53d7cb4 + 209f2ab
commit 864708c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/src/Providers/GithubProvider.php b/src/Providers/GithubProvider.php
@@ -14,10 +14,10 @@ class GithubProvider extends AbstractProvider
      */
     public function verify(Request $request): bool
     {
-        $header = $request->header('HTTP_X_HUB_SIGNATURE_256');
+        $header = $request->header('X-Hub-Signature-256');
         $signature = hash_hmac('sha256', $request->getContent(), $this->secret);
 
-        return hash_equals($header, $signature);
+        return hash_equals(substr($header, 7), $signature);
     }
 
     /**

diff --git a/tests/GithubProviderTest.php b/tests/GithubProviderTest.php
@@ -14,7 +14,7 @@ public function test_it_can_receive_github_webhook()
     {
         Log::partialMock()->shouldReceive('info')->never();
 
-        $signature = '5a84f1914825f5625cb82b1a894d7c6a8a851b7908f0134149b251b3b03880ed';
+        $signature = 'sha256=5a84f1914825f5625cb82b1a894d7c6a8a851b7908f0134149b251b3b03880ed';
 
         $request = Mockery::mock(Request::class);
         $this->signUsing($request, $signature);
@@ -35,7 +35,7 @@ public function test_it_dispatches_matching_handler()
     {
         Log::partialMock()->shouldReceive('info')->withArgs(['Webhook handled.'])->andReturnNull();
 
-        $signature = '5a84f1914825f5625cb82b1a894d7c6a8a851b7908f0134149b251b3b03880ed';
+        $signature = 'sha256=5a84f1914825f5625cb82b1a894d7c6a8a851b7908f0134149b251b3b03880ed';
 
         $request = Mockery::mock(Request::class);
         $this->signUsing($request, $signature);
@@ -63,7 +63,7 @@ public function test_it_dispatches_matching_handler()
     protected function signUsing(Request $request, string $signature): Request
     {
         $request->allows('getContent')->andReturns(json_encode($this->mockPayload()));
-        $request->allows('header')->with('HTTP_X_HUB_SIGNATURE_256')->andReturns($signature);
+        $request->allows('header')->with('X-Hub-Signature-256')->andReturns($signature);
 
         return $request;
     }