docs/webhooks: use subtle.ConstantTimeCompare for comparing signatures
Fixes
import (
"crypto/hmac"
"crypto/sha256"
+ "crypto/subtle"
"encoding/hex"
"encoding/json"
"errors"
@@ -95,7 +96,7 @@ func verifyWebhookSignature(req *http.Request, secret string) (events []event, e
// Verify that the signatures match.
var match bool
for _, signature := range signatures[currentVersion] {
- if signature == want {
+ if subtle.ConstantTimeCompare([]byte(signature), []byte(want)) == 1 {
match = true
break
}
