X-Hub-Signature Koa Middleware.

Add the middleware to Koa. It needs to be after bodyParser().

const Koa = require('koa');
const bodyParser = require('koa-bodyparser');
const xHub = require('koa-x-hub');

const app = new Koa();
app.use(bodyParser());
app.use(xHub({algorithm: 'sha1', secret: XHUB_SECRET_HERE}));

Where XHUB_SECRET_HERE is your platform's (facebook, github, etc) secret.

This will add some special sauce to your ctx.request object:

Is the request X-Hub. Allows you to early reject any messages without XHub content.

if (!ctx.request.isXHub) { ctx.throw(403, 'No X-Hub Signature'); }

Returns a boolean value. Validates the request body against the X-Hub signature using your secret.

if (!ctx.request.isXhub || !ctx.request.isXHubValid()) { ctx.throw(403, 'Invalid X-Hub Request'); }

If it's valid, then the request has not been tampered with and you are safe to process it.

• secret: X-Hub secret that is used to validate the request body against the signed X-HUB signature on the header. Required.
• algorithm: Encryption algorithm used to generate the signature. Default is sha1.

MIT

This project is inspired by express-x-hub.