Treatment verify

crypto/signature/hmac::verify

Parameters

↳ var algorithm: string = "sha256"
↳ var encoding: string = "hex"
↳ var key: Secret<string>
↳ var prefix: string = ""

Inputs

⇥ data: Stream<byte>
⇥ signature: Block<Option<string>>

Outputs

↦ error: Block<string>
↦ failed: Block<void>
↦ invalid: Block<void>
↦ valid: Block<void>

Verifies the HMAC signature of data.

The HMAC of the bytes received through data is computed with key and algorithm (sha256, sha384, sha512, or sha1 for services still using it, such as Twilio or the legacy X-Hub-Signature header of GitHub), and compared in constant time with signature, once data ends. signature is encoded with encoding (hex, in any case, base64, or base64url, with or without padding), and starts with prefix when given, such as sha256= for GitHub webhooks (X-Hub-Signature-256 header). The key is revealed when the treatment starts.

valid is emitted if signature matches, invalid otherwise, including when signature is none, lacks prefix, or is not validly encoded. If the key cannot be revealed, or algorithm or encoding is not supported, failed is emitted and error contains the reason.