ruby 34 lines · 7 steps

Verifying webhook signatures with Rails routing constraints

A routing constraint validates an HMAC signature before a webhook request ever reaches its controller.

Explained by highlit

Rails Advanced routing constraints hmac webhooks security timing-safe comparison

1class WebhookSignatureConstraint
def initialize(provider)
  @provider = provider
end
5 
def matches?(request)
  signature = request.headers["X-Webhook-Signature"].to_s
  return false if signature.blank?
9 
  payload = request.raw_post
  expected = OpenSSL::HMAC.hexdigest(
    "SHA256",
    Rails.application.credentials.dig(:webhooks, @provider, :secret),
    payload
  )
16 
  ActiveSupport::SecurityUtils.secure_compare("sha256=#{expected}", signature)
end
19end
20 
21Rails.application.routes.draw do
namespace :webhooks do
  constraints(WebhookSignatureConstraint.new(:stripe)) do
    post "stripe", to: "stripe#create"
  end
26 
  constraints(WebhookSignatureConstraint.new(:github)) do
    post "github", to: "github#create"
  end
30 
  post "stripe", to: "rejected#unauthorized"
  post "github", to: "rejected#unauthorized"
end
34end

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Routing constraints can gate requests on request content, not just path patterns.
2Always compare signatures with a constant-time function to defeat timing attacks.
3Ordering routes lets a fallback catch requests that fail the constraint.

Related explainers

javascript

const MAX_FILE_SIZE = 5 * 1024 * 1024;
 
const ALLOWED_TYPES = {
  'image/jpeg': ['jpg', 'jpeg'],

Validating file uploads by content, not just claims

input-validation security magic-bytes

Intermediate 7 steps

ruby

module UniqueJob
  extend ActiveSupport::Concern
 
  class_methods do

Deduplicating Active Job enqueues in Rails

concurrency idempotency caching

Advanced 9 steps

ruby

class OrderMailerPreview < ActionMailer::Preview
  def confirmation
    OrderMailer.confirmation(sample_order)
  end

Previewing Rails mailers with sample data

mailer-previews test-fixtures in-memory-objects

Beginner 6 steps

python

from fastapi import FastAPI, Request, status
from fastapi.encoders import jsonable_encoder
from fastapi.exceptions import RequestValidationError
from fastapi.responses import JSONResponse

Redacting sensitive fields in FastAPI errors

validation error-handling security

Intermediate 7 steps

ruby

def render_table(rows)
  return "(no data)" if rows.empty?
 
  columns = rows.flat_map(&:keys).uniq

Rendering an ASCII table in Ruby

text-formatting column-alignment recursion

Intermediate 8 steps

ruby

class ApplicationController < ActionController::Base
  ALLOWED_REDIRECT_HOSTS = [nil, ENV.fetch("APP_HOST", "app.example.com")].freeze
 
  def store_return_to(location = request.fullpath)