Webhook security

Each webhook has an associated secret you can use to verify that the request came from KanbanFlow. The request made to your URL endpoint will contain a special header called X-KanbanFlow-Signature. The signature is a HMAC-SHA256 hex digest of the payload using the secret as the key. Exactly how to verify the signature depends on your platform. Using Node.js for example, the signature can be verified as follows:

import crypto from 'crypto';

function verifyKanbanFlowWebhookRequest(request, secret) {
  const content = request.body;
  const digest = crypto.createHmac('sha256', secret).update(content).digest('hex');
  const expectedSignature = Buffer.from('sha256=' + digest);
  const signature = Buffer.from(request.headers['x-kanbanflow-signature'] || '');
  return signature.length === expectedSignature.length && crypto.timingSafeEqual(signature, expectedSignature);
}

Note that request.body must be the raw request body, exactly as it was received. If the body has been parsed as JSON, the signature will not match. With Express, you can for example use express.raw({ type: 'application/json' }) to get the raw body.

Use crypto.timingSafeEqual to compare the signatures instead of ===. A normal string comparison can leak information about the signature through timing differences.