Anu.Webhook.Signature (Anu v0.2.1)

HMAC-SHA256 signature verification for Meta webhook payloads.

Meta signs each webhook POST request with the app secret. This module computes the expected signature and compares it using constant-time comparison to prevent timing attacks.

Summary

Functions

verify(body, arg2, secret)

Verifies that the given signature matches the HMAC-SHA256 of the body.

Functions

verify(body, arg2, secret)

@spec verify(binary(), String.t(), String.t()) :: :ok | {:error, :invalid_signature}

Verifies that the given signature matches the HMAC-SHA256 of the body.

The signature parameter is the value of the x-hub-signature-256 header, which has the format "sha256=<hex_digest>".

Returns :ok if valid, {:error, :invalid_signature} otherwise.

Examples

iex> body = ~S({"entry":[]})
iex> secret = "test_secret"
iex> mac = :crypto.mac(:hmac, :sha256, secret, body) |> Base.encode16(case: :lower)
iex> Anu.Webhook.Signature.verify(body, "sha256=" <> mac, secret)
:ok

iex> Anu.Webhook.Signature.verify("body", "sha256=invalid", "secret")
{:error, :invalid_signature}