github service hook and basic authentication

Question

I'm trying to figure out how to secure a webhook reciever for a github service hook.

In the github manual pages, when you look in the section on what IP addresses github hooks will come from, it has this warning:

"We highly recommend that you don't white list IPs for Service Hooks. Instead, setup HTTPS and basic authentication to verify incoming requests."

In the documentation on post receive hooks I don't see any way to set up basic authentication.

How can I use basic authentication with github post-recieve/service/web hook that notifies me of a commit to a repository?

superset question: how to do authenticated webhooks: http://stackoverflow.com/questions/9007030/how-to-verify-a-post-receive-hook-request-actually-came-from-github — Ciro Santilli OurBigBook.com, Aug 05 '14 at 20:03
I saw that too; but the accepted answer is exactly what the quote above from github says NOT to do. All the answers on that page seem sort of hokey, except for http://stackoverflow.com/a/20856954/1763984 which didn't used to be there (and I just upvoted it) — Brian Tingle, Aug 05 '14 at 20:12

score 18 · Accepted Answer · answered Aug 26 '13 at 19:13

18

I think you can just use

https://yourUser:yourSecret@yoursite.net/path

like in any basic auth situation.

answered Aug 26 '13 at 19:13

Ax3l

I just tried it right now: Go to your Repository->Settings->Service Hooks and use the syntax above in your WebhookUrl :) – Ax3l Aug 26 '13 at 20:04

1 Answers1