How to verify a post-receive hook request actually came from github?

Question

Github offers a way to let a URL know when a project has been updated using webhooks.

How do I verify that a post sent to my server\'s post-receive hook act

Answer 1

You can ping GitHub's Meta API to get an array of IP addresses (in CIDR notation) that the incoming service hooks will originate from and cross check them against the request's IP :

https://api.github.com/meta

Answer 2

In addition to @mnml's answer, the second step could be to just call up the API and verify that the information given matches the last known commit for the project. It's the same process that OpenID uses to verify the data passed is valid.

So, first I could defeat dumb reply attacks, by just checking the IP. Next I could ask github if the information I received is correct.

GET /repos/:user/:repo/commits/:sha

Answer 3

You can try to check Github's post-request IP : 207.97.227.253, 50.57.128.197, 108.171.174.178

Answer 4

You could locate your webhook at a hard-to-guess URL. Say:

https://my-host.com/webhooks/E36006BE2C4BABDEEF307C77E34F415B/my-hook

(That's 128-bits of random data - increase to whatever size feels comfortable). Assuming you can trust github to keep this url secure, it's pretty likely that a client hitting that url can be trusted.

If the url should ever be compromised, it's a simple matter to just generate a new random URL and update your webserver.

Just make sure you're using a good source of entropy...

Answer 5

Take a look at GitHub's docs on the subject: they suggest using HTTPS and basic authentication.

Specifically, set up your Payload URL in this format:

https://yourUser:yourPass@yoursite.net/path

If you have a number of users, you'd give each a different username & password. Assuming they keep that password private, you can then trust that an authenticating request really does come from GitHub and from that account.

See also: https://github.com/blog/237-basic-auth-post-receives