Mandrill API Webhook signature verification. This shows how you could verify a Mandrill signature in a Rails Controller.

webhooks_controller.rb

class WebhooksController < ActionController::Base

  WEBHOOK_KEY = "some_key" # You could also use an API request to lookup the key

  before_filter :verify_request_signature

  # See: http://help.mandrill.com/entries/23704122-Authenticating-webhook-requests
  def verify_request_signature
    signed_data = request.url
    post_params = request.request_parameters.dup # POST parameters
    signed_data += request.request_parameters.sort.join
    signature = Base64.strict_encode64(OpenSSL::HMAC.digest('sha1',WEBHOOK_KEY,signed_data))
    logger.debug("our: #{signature}, mandrill: #{request.headers['X-Mandrill-Signature']}")
    # Do something here.. compare them..
  end

end

Thanks !

Thanks for this! Heads up, line 11 should be signed_data += post_params.sort.join