Skip to content

Commit

Permalink
Fix code lint
Browse files Browse the repository at this point in the history
  • Loading branch information
jordrake committed Aug 7, 2024
1 parent 12dea5d commit 744285b
Showing 1 changed file with 6 additions and 4 deletions.
10 changes: 6 additions & 4 deletions api-reference/request-signing.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@
title: 'Request signing'
---

We sign outbound requests we make to your target URLs with a HMAC signature using a shared secret key. This allows you to verify that the request was made by Plain and not a third party.
We sign outbound requests we make to your target URLs with a HMAC signature using a shared secret key. This allows you to verify that the request was made by Plain and not a third party.

## How to verify

Your workspace has a global HMAC secret, this secret can be viewed and (re)generated by workspace admins in **Settings****Request signing**.
Your workspace has a global HMAC secret, this secret can be viewed and (re)generated by workspace admins in **Settings****Request signing**.

If you have a HMAC secret set up, when you receive a request from Plain you will see a header `Plain-Request-Signature` with the HMAC signature.
You can verify this signature by hashing the request body with your HMAC secret and comparing it to the signature in the header.
Expand All @@ -22,10 +22,12 @@ const crypto = require('crypto');
const requestBody = JSON.stringify(request.body);

const incomingSignature = request.headers['Plain-Request-Signature'];
const expectedSignature = crypto.createHmac('sha-256', '<HMAC SECRET>').update(requestBody).digest('hex');
const expectedSignature = crypto
.createHmac('sha-256', '<HMAC SECRET>')
.update(requestBody)
.digest('hex');

if (incomingSignature !== expectedSignature) {
return response.status(403).send('Forbidden');
}
```

0 comments on commit 744285b

Please sign in to comment.