github/hubot — pull request #626 by joshuarubin (2013-12-31 22:56:48+00:00)
Title: Add x-hub-signature Header Verification to HTTP Requests

If an incoming HTTP request has the `x-hub-signature` header set and the `HUB_SECRET` environment variable is set, verify that the signature is valid.

An invalid signature will not be processed as an error will be thrown from the middleware.

If either the `HUB_SECRET` environment variable isn't set or the `x-hub-signature` header wasn't present in the request, then verification will be bypassed. However, `req.hubVerified` will be undefined.

Any script that wants to ensure only verified requests will be processed can do so like this:

```coffeescript
module.exports = (robot) ->
robot.router.post "/some/url",
robot.requireHubSignature,
fn
```

The version of express must also be updated so that it includes the latest connect middleware that provides the verification capability.