How to Validate GitHub Webhooks Using HMAC SHA-256 in PHP and Node.js

·1 views

GitHub webhooks can be exploited if endpoints blindly trust incoming payloads, making signature verification a critical security step. When GitHub dispatches a webhook, it computes an HMAC SHA-256 signature using the raw request body and a shared secret, sending the result in the X-Hub-Signature-256 header. Developers must recalculate this signature server-side from the raw body and compare it against the header value using constant-time comparison functions to prevent timing attacks. In PHP, hash_hmac() and hash_equals() handle this securely, while Node.js offers createHmac() and timingSafeEqual() from the native crypto module. A key implementation detail is that validation must use the raw request body before any JSON parsing, since even minor byte-level changes will produce a different HMAC and cause legitimate requests to fail.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI-Farmed 'Drive-By' PRs Are Wasting Open Source Maintainers' Time

Open source maintainers are increasingly dealing with 'drive-by' pull requests — contributions submitted with no intention of follow-through, often generated by AI tools pointed at repositories en masse. The pattern typically involves using a large language model to identify fixes, submitting the output across dozens of repos, and never responding to maintainer feedback. These abandoned PRs waste reviewer time and clog project queues, making repositories appear unmaintained to genuine contributors. Maintainers are advised to set explicit response deadlines, close stale PRs without hesitation, and state anti-drive-by policies clearly in contributing guidelines. Contributors are urged to read the code they submit, engage with feedback, and only open PRs they are prepared to see through to completion.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Angular HTTP Interceptors Automate JWT Auth and Token Refresh

A developer has shared a technique for managing JWT authentication in Angular applications using an HTTP interceptor. The interceptor automatically attaches an access token to every outgoing API request, eliminating the need to add authorization headers manually in each service. When a request returns a 401 Unauthorized error, the interceptor attempts to silently refresh the access token using a stored refresh token before retrying the original request. If the refresh token is also expired or invalid, the user's session data is cleared and they are redirected to the login page. A key safeguard prevents infinite loops by detecting when the failed request is itself the refresh endpoint, triggering an immediate logout instead of another refresh attempt.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

India's DPDP Rules Notified; Most Compliance Deadlines Fall in 2027

India's Digital Personal Data Protection Act, 2023 received presidential assent in August 2023 but remained without operative rules for two years. On November 13, 2025, the Ministry of Electronics and Information Technology notified the DPDP Rules, 2025, and formally established the Data Protection Board of India. The Rules introduce a staggered enforcement timeline: provisions for Consent Managers take effect from November 13, 2026, while the bulk of obligations — including consent requirements, data principal rights, and breach notification penalties — become enforceable from May 13, 2027. The Act defines three key roles: Data Fiduciary (companies deciding how data is processed), Data Processor (vendors handling data on their behalf), and Data Principal (the individual whose data is collected). While most deadlines are roughly 18 months away, legal experts note that the regulatory framework is now active, giving product teams a finite window to build compliant data architectures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer with 25 years of experience returns to DEV to share real-world engineering lessons

A software developer who has been programming since the early 2000s has announced a return to the DEV Community platform to document lessons learned across more than 25 years of building systems, SaaS products, APIs, and automations. The author previously published on DEV in 2024 but shared little of their ongoing work, much of which remained private due to client projects. They are currently working on several active products, including a GitHub webhook inspector, a Bible content API, and a lightweight analytics platform. Going forward, they plan to write about architecture decisions, SaaS validation, AI agents, and the intersection of code, product, and business. The author emphasizes that technology only creates value when it solves concrete problems, and that shipping and iterating consistently outweighs indefinite planning.

0 comments Read more at DEV Community