Clojurians Log v2

Has anyone been playing with yada and github hooks already? I am not able to compute the hmac as described here https://developer.github.com/webhooks/securing/ I don’t know if my method of getting the body is correct. I tried: - json/stringify the body parsed by yada it doesn’t seem to work - making an interceptor to get the raw bytes

(insert-interceptor
       (yada/handler
         (yada/resource
           {:methods
            {:post
             {:consumes consumes
              :produces produces
              :response hook-handler}}}))
       yada.interceptors/process-request-body (fn [ctx]
(if-let [gh-sig (get-in ctx [:request :headers "x-hub-signature"])]
  (let [raw-body (manifold.stream/take! (:body (:request ctx)))]
    ;; will need to put! it back?
    (let [body @raw-body
          ba (byte-array (.readableBytes body))
          by (.getBytes (.retainedDuplicate @raw-body) 0 ba)]
      (println (hmac
                 by
                 gh-sig)))

    ctx)
  ctx)
   )

Don't have any specific experience there, but you'll want to be careful about ordering of the keys in the JSON payload

If they are parsed by Yada into a Clojure data structure and then converted back then you may not get the same order

But that's not really what you're doing there

@nha I think you need to be calculating the HMAC based on the bytes that GitHub is giving you and the secret key that you've set

And then you do a secure compare to compare that with X-Hub-Signature

You're calculating a HMAC using the X-Hub-Signature, which won't give you what you want