module SquareEvent::Webhook::Signature

Public Class Methods

verify_header(payload, signature, secret, notification_url) click to toggle source

Computes a webhook signature given payload, and a signing secret

# File lib/square_event/webhook.rb, line 18
def self.verify_header(payload, signature, secret, notification_url)
  combined_payload = notification_url + payload
  digest = OpenSSL::Digest.new('sha1')
  hmac = OpenSSL::HMAC.digest(digest, secret, combined_payload)

  # stripping the newline off the end
  found_signature = Base64.encode64(hmac).strip

  if found_signature != signature
    raise SignatureVerificationError.new(
      "Signature was incorrect for webhook at #{notification_url}",
      http_body: payload
    )
  end
end