16

Github offers a way to let a URL know when a project has been updated using webhooks.

How do I verify that a post sent to my server's post-receive hook actually came from github?

Should I check the IP address of the sender or can I send an auth check somewhere? I want to make sure someone doesn't try to spoof a request pretending to be from github.

One option is to setup the hook through PubSubHubbub and use the hub.secret option to create a SHA1 HMAC signature of the post body. However, that would require my server setting up the request rather than waiting for users to setup the post-receive callback to my site when they want to. I would rather just ask users to paste the URL I give them into the post url.

Ciro Santilli OurBigBook.com
  • 347,512
  • 102
  • 1,199
  • 985
Xeoncross
  • 55,620
  • 80
  • 262
  • 364

5 Answers5

10

You can ping GitHub's Meta API to get an array of IP addresses (in CIDR notation) that the incoming service hooks will originate from and cross check them against the request's IP :

https://api.github.com/meta

jesal
  • 7,852
  • 6
  • 50
  • 56
9

Take a look at GitHub's docs on the subject: they suggest using HTTPS and basic authentication.

Specifically, set up your Payload URL in this format:

https://yourUser:yourPass@yoursite.net/path

If you have a number of users, you'd give each a different username & password. Assuming they keep that password private, you can then trust that an authenticating request really does come from GitHub and from that account.

See also: https://github.com/blog/237-basic-auth-post-receives

Rowan
  • 2,585
  • 4
  • 24
  • 34
7

You can try to check Github's post-request IP : 207.97.227.253, 50.57.128.197, 108.171.174.178

Roch
  • 21,741
  • 29
  • 77
  • 120
  • 1
    So simple I didn't even consider it. The data is not super important, I just want to stop simple spam submissions. – Xeoncross Feb 21 '12 at 18:21
  • 2
    According to Github, the actual addresses are 207.97.227.253, 50.57.128.197, 108.171.174.178. – Joshua May 09 '12 at 21:30
  • 6
    This sounds fragile. If github ever changes those IP addresses, you'll have to update your list. Perhaps you can do a reverse DNS lookup and ensure that the resulting domain name ends with "github.com". – offby1 Jun 03 '12 at 20:25
  • @Joshua, can you please provide the source for that IP address information? I'm having trouble finding any information on github.com. Thanks! – Daniel Oct 17 '12 at 15:59
  • 1
    I've seen those IPs too. Go to the Admin/Settings part of a repo, click Service Hooks, then click WebHook URLs. You'll see a message on the right: "The Public IP addresses for these hooks are: 207.97.227.253, 50.57.128.197, 108.171.174.178." – Rich Dougherty Dec 11 '12 at 09:00
  • Don't use the above addresses, go get the current ones (a CIDR Range) as described in the comment by @RichDougherty – Merrick Oct 04 '13 at 15:30
  • 1
    Don't look up IPs. Github has specific recommendations on verifying requests... see @Rowan's answer. – bryanbraun May 12 '14 at 21:26
5

In addition to @mnml's answer, the second step could be to just call up the API and verify that the information given matches the last known commit for the project. It's the same process that OpenID uses to verify the data passed is valid.

So, first I could defeat dumb reply attacks, by just checking the IP. Next I could ask github if the information I received is correct.

GET /repos/:user/:repo/commits/:sha
Xeoncross
  • 55,620
  • 80
  • 262
  • 364
  • Yep I also use the json data to trigger capistrano and deploy depending on the branch of the commit – Roch Feb 23 '12 at 15:15
  • 5
    **This is not safe** – everybody can add commits to your repo by creating pull requests. See here: https://api.github.com/repos/github/gitignore/git/commits/85be394529d93cb7f29cd758599e7d103dc002f8. Part of this (not merged!) pull request: https://github.com/github/gitignore/pull/542. – Chronial Mar 04 '13 at 01:09
3

You could locate your webhook at a hard-to-guess URL. Say:

https://my-host.com/webhooks/E36006BE2C4BABDEEF307C77E34F415B/my-hook

(That's 128-bits of random data - increase to whatever size feels comfortable). Assuming you can trust github to keep this url secure, it's pretty likely that a client hitting that url can be trusted.

If the url should ever be compromised, it's a simple matter to just generate a new random URL and update your webserver.

Just make sure you're using a good source of entropy...

Kris Pruden
  • 3,280
  • 4
  • 25
  • 30