Secure GitHub Webhooks with HMAC256 Signature Validation

This n8n workflow provides a robust solution for securely handling GitHub webhooks by validating their HMAC256 signatures. It ensures that incoming webhook payloads are legitimate and have not been tampered with, protecting your applications from unauthorized requests.

What it does

This workflow automates the following steps:

1. Listens for GitHub Webhooks: It acts as an endpoint to receive incoming webhook events from GitHub.
2. Extracts Signature Header: It retrieves the X-Hub-Signature-256 header from the incoming request, which contains the HMAC SHA256 signature.
3. Generates Local Signature: Using the raw body of the incoming webhook and a pre-configured secret key, it calculates its own HMAC SHA256 signature.
4. Compares Signatures: It compares the locally generated signature with the one provided in the X-Hub-Signature-256 header.
5. Validates or Rejects:
   • If the signatures match, the webhook is considered valid, and the workflow can proceed with further processing (e.g., triggering other actions based on the GitHub event).
   • If the signatures do not match, the workflow stops and returns an error, preventing the processing of potentially malicious or unauthorized requests.
6. Responds to Webhook: For valid requests, it sends a successful response back to GitHub. For invalid requests, it sends an error response.

Prerequisites/Requirements

• n8n Instance: A running instance of n8n (self-hosted or cloud).
• GitHub Webhook Secret: A secret key configured in your GitHub repository's webhook settings. This same secret must be configured in the n8n workflow.

Setup/Usage

1. Import the Workflow: Import the provided JSON into your n8n instance.
2. Configure the Webhook Trigger:
   • Open the "Webhook" node.
   • Copy the "Webhook URL" provided by n8n.
3. Configure GitHub Webhook:
   • Go to your GitHub repository settings.
   • Navigate to "Webhooks" and click "Add webhook".
   • Paste the n8n Webhook URL into the "Payload URL" field.
   • Select "application/json" as the "Content type".
   • Enter a Secret key. This secret must be strong and unique.
   • Choose which events you want to trigger the webhook (e.g., "Just the push event", "Send me everything", or "Let me select individual events").
   • Click "Add webhook".
4. Configure the Crypto Node:
   • Open the "Crypto" node in the n8n workflow.
   • In the "Key" field, enter the exact same Secret key you configured in GitHub.
   • Ensure the "Algorithm" is set to "sha256" and "Encoding" is "hex".
5. Activate the Workflow: Save and activate the n8n workflow.

Now, any incoming GitHub webhook events to your n8n endpoint will be automatically validated for their HMAC256 signature, ensuring their authenticity before further processing.