mailgun/mailgun-php — pull request #50 by gmacon (2014-06-24 21:49:25+00:00)
Title: Add Mailgun->verifyWebhookSignature()

It would save a lot of development time (added up over all the projects)
to have a function to verify the webhook signature in the library. This
will also be more conducive to secure implementations, since only the
library developers have to figure out how to do a constant-time
comparison.

I've implemented this function as a method on the Mailgun object and
provided two unit tests. The current implementation uses hash_equals
(the constant-time comparison function introduced in PHP 5.6) to compare
the hashes if it is available and falls back to the == operator
otherwise.