Verify GitHub webhook request sha256 in PHP

verify-github-webhook.php

<?php

// It's better to be exported as an environment variable or in a .env file.
define("SECRET", "<SECRET>");

$body = file_get_contents("php://input");
// $decodedBody = json_decode(urldecode($body));

if (verifySignature($body) !== false) {
  // verified
} else {
  // unverified
  http_response_code(403);
  echo "unauthorized";
}

function verifySignature($body){
  $headers = getallheaders();
  return hash_equals('sha256='.hash_hmac('sha256', $body, SECRET), $headers['x-hub-signature-256']); 
}

Thank you!

For me, it only worked if the header was in the correct case: X-Hub-Signature-256. So, if anyone is having issues, try this.

For me, it only worked if the header was in the correct case: X-Hub-Signature-256. So, if anyone is having issues, try this.

Thank you @gaborszita!