{"id":18821151,"url":"https://github.com/compwright/x-hub-signature-middleware","last_synced_at":"2026-05-10T03:45:57.581Z","repository":{"id":62716230,"uuid":"561492423","full_name":"compwright/x-hub-signature-middleware","owner":"compwright","description":"X-Hub-Signature webhook verification middleware for Express and Node.js","archived":false,"fork":false,"pushed_at":"2022-11-03T20:20:02.000Z","size":140,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-01-30T10:48:16.775Z","etag":null,"topics":["express","middleware","nodejs","x-hub-signature"],"latest_commit_sha":null,"homepage":"https://www.npmjs.com/package/x-hub-signature-middleware","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/compwright.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null},"funding":{"github":"compwright"}},"created_at":"2022-11-03T20:11:23.000Z","updated_at":"2022-11-03T20:20:54.000Z","dependencies_parsed_at":"2022-11-05T01:00:18.737Z","dependency_job_id":null,"html_url":"https://github.com/compwright/x-hub-signature-middleware","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/compwright%2Fx-hub-signature-middleware","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/compwright%2Fx-hub-signature-middleware/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/compwright%2Fx-hub-signature-middleware/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/compwright%2Fx-hub-signature-middleware/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/compwright","download_url":"https://codeload.github.com/compwright/x-hub-signature-middleware/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239758831,"owners_count":19692034,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["express","middleware","nodejs","x-hub-signature"],"created_at":"2024-11-08T00:34:39.957Z","updated_at":"2026-01-17T21:30:23.078Z","avatar_url":"https://github.com/compwright.png","language":"JavaScript","funding_links":["https://github.com/sponsors/compwright"],"categories":[],"sub_categories":[],"readme":"# X-Hub-Signature tools for Node.js and Express\n\n[![Build Status](https://app.travis-ci.com/compwright/x-hub-signature-middleware.svg?branch=master)](https://app.travis-ci.com/github/compwright/x-hub-signature-middleware)\n[![Download Status](https://img.shields.io/npm/dm/x-hub-signature-middleware.svg?style=flat-square)](https://www.npmjs.com/package/x-hub-signature-middleware)\n[![Sponsor on GitHub](https://img.shields.io/static/v1?label=Sponsor\u0026message=❤\u0026logo=GitHub\u0026link=https://github.com/sponsors/compwright)](https://github.com/sponsors/compwright)\n\nX-Hub-Signature is a compact way to validate real-time updates, such as webhooks from [Facebook](https://developers.facebook.com/docs/graph-api/webhooks/) and [GitHub](https://developer.github.com/webhooks/securing/).\n\nRequires Node.js 16+\n\n## Getting Started\n\nTo install:\n\n```shell\nnpm install x-hub-signature-middleware --save\n```\n\n## Express Middleware\n\nTo validate incoming webhooks signed with `X-Hub-Signature`, use the bundled Express middleware.\n\n```javascript\nconst { xHubSignatureMiddleware } = require('x-hub-signature');\napp.use(xHubSignatureMiddleware({\n  algorithm: 'sha1',\n  secret: 'secret',\n  require: true,\n  getRawBody: req =\u003e req.rawBody\n}));\n```\n\n**Options:**\n\n* `algorithm` (required) - `sha1` or other desired signing algorithm\n* `secret` (required) - signing secret that the webhook was signed with\n* `require` (optional) - boolean, whether to require the presence of the `X-Hub-Signature` header. If true, throws an HTTP 400 error if the header is not present. If false, the middleware will pass the request on if the header is not present, and validate the header only if it is present. (default: `true`)\n* `getRawBody` (optional) - function that accepts `req` as the first argument and returns the raw body. If you use the bundled body-parser verifier (see below), you don't need to set this option.\n* `header` (optional) - the default header is `X-Hub-Signature`. For `sha256`, the header needs to be `X-Hub-Signature-256`.\n\n### Use with body-parser\n\nA very common case is to have [body-parser](https://github.com/expressjs/body-parser) middleware globally defined. This produces complications for the x-hub-signature middleware, since it needs a copy of the raw unparsed body, and `body-parser` by default does not save this on the request.\n\nIn this case, you can use the bundled `extractRawBody` verifier function with body-parser. This will set a reference to the buffered raw (unparsed) body to `req.rawBody`:\n\n```javascript\nconst bodyParser = require('body-parser');\nconst {xHubSignatureMiddleware, extractRawBody} = require('x-hub-signature-middleware');\napp.use(bodyParser.json({\n  verify: extractRawBody\n}))\napp.use(xHubSignatureMiddleware({\n  algorithm: 'sha1',\n  secret: 'secret',\n  require: true\n}));\n```\n\n## License\n\nMIT License\n\n## Acknowledgements\n\nThis project was based on [express-x-hub](https://github.com/alexcurtis/express-x-hub) by Alex Curtis.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcompwright%2Fx-hub-signature-middleware","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcompwright%2Fx-hub-signature-middleware","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcompwright%2Fx-hub-signature-middleware/lists"}