New Case Study:See how Anthropic automated 95% of dependency reviews with Socket.Learn More
Socket
Sign inDemoInstall
Socket

calamarble-xhub

Package Overview
Dependencies
Maintainers
1
Versions
21
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

calamarble-xhub - npm Package Compare versions

Comparing version 0.4.2 to 0.5.0

2

package.json
{
"name": "calamarble-xhub",
"description": "xhub signature verification for POST requests from facebook",
"version": "0.4.2",
"version": "0.5.0",
"main": "./src/index.js",

@@ -6,0 +6,0 @@ "scripts": {

@@ -22,4 +22,4 @@ # X-Hub-Signature check

const xHubConfig = {
xHubAlgo: 'sha1',
xHubSecret: 'MY_APP_SECRET',
algo: 'sha1',
secret: 'MY_APP_SECRET',
messages: {

@@ -29,8 +29,7 @@ wrongSignature: 'Content signature don\'t match'

};
const config = Object.assign({}, expressConfig, xHubConfig);
const app = express();
const postEndPoint = apiEndpoint(config);
const postEndPoint = apiEndpoint(xHubConfig);
app.use(bodyParser.raw({ type: 'application/json' }));
app.post(config.postPath, postEndPoint);
app.listen(config.port, () => console.log(`Server running on port ${config.port}`));
app.post(expressConfig.postPath, postEndPoint);
app.listen(expressConfig.port, () => console.log(`Server running on port ${expressConfig.port}`));

@@ -46,5 +45,5 @@ ```

const api = new ApiBuilder();
const config = {
xHubAlgo: 'sha1',
xHubSecret: 'MY_APP_SECRET',
const xHubConfig = {
algo: 'sha1',
secret: 'MY_APP_SECRET',
messages: {

@@ -55,5 +54,30 @@ wrongSignature: 'Content signature don\'t match'

api.post('/fbwebhook', webhookPost(config));
api.post('/fbwebhook', webhookPost(xHubConfig));
export { api as default };
```
### With claudia-api-builder and a callback
```javascript
import ApiBuilder from 'claudia-api-builder';
import { apiEndpoint as webhookPost} from 'calamarble-xhub';
const api = new ApiBuilder();
const myCallback = (req, res) => {
return { foo: 'bar' };
}
const xHubConfig = {
algo: 'sha1',
secret: 'MY_APP_SECRET',
messages: {
wrongSignature: 'Content signature don\'t match'
},
next: myCallback
}
api.post('/fbwebhook', webhookPost(xHubConfig));
export { api as default };
```

@@ -20,5 +20,6 @@ 'use strict';

const defaultConfig = {
xHubAlgo: 'sha1',
xHubSecret: '',
const defaultXHubConfig = {
algo: 'sha1',
secret: '',
next: null,
messages: {

@@ -34,4 +35,3 @@ wrongSignature: 'X-Hub-Signatures do not match.'

const apiEndpoint = userConfig => (req, res) => {
const config = _extends({}, defaultConfig, userConfig);
const signatureMatches = (config, req) => {
const rawBody = req.rawBody || req.body;

@@ -41,14 +41,18 @@ const headers = req.headers;

const headerSignature = xHubSignature.split('=')[1];
const signatureMatches = verifySignature(config.xHubAlgo, config.xHubSecret, headerSignature, rawBody);
// console.log('serverSignature:', serverSignature);
// console.log('X-Hub-Signature', xHubSignature);
// console.log('rawBody', rawBody);
if (!signatureMatches) {
return verifySignature(config.xHubAlgo, config.xHubSecret, headerSignature, rawBody);
};
const apiEndpoint = userConfig => (req, res) => {
const config = _extends({}, defaultXHubConfig, userConfig);
if (!signatureMatches(config, req)) {
console.error(config.messages.wrongSignature);
throw config.messages.wrongSignature;
}
const result = { success: true };
return res ? res.send(result) : result;
if (!config.cb) {
const result = { success: true };
return res ? res.send(result) : result;
}
return config.next(req, res);
};
exports.apiEndpoint = apiEndpoint;
SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc