Webhooks

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, encryptionKey) {
  // Create HMAC using your Encryption Key
  const hmac = crypto.createHmac('sha256', encryptionKey);
  
  // Update with the raw JSON body
  hmac.update(payload, 'utf8');
  
  // Generate the expected signature
  const expectedSignature = hmac.digest('hex');
  
  // Compare signatures
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}

// Usage in Express.js
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const payload = req.body.toString();
  
  if (!verifyWebhookSignature(payload, signature, process.env.ENCRYPTION_KEY)) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook
  const webhookData = JSON.parse(payload);
  console.log('Webhook verified:', webhookData);
  
  res.status(200).send('OK');
});

import hmac
import hashlib
import json

def verify_webhook_signature(payload, signature, encryption_key):
    # Create HMAC using your Encryption Key
    expected_signature = hmac.new(
        encryption_key.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    
    # Compare signatures securely
    return hmac.compare_digest(signature, expected_signature)

# Usage in Flask
from flask import Flask, request

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature')
    payload = request.get_data(as_text=True)
    
    if not verify_webhook_signature(payload, signature, app.config['ENCRYPTION_KEY']):
        return 'Invalid signature', 401
    
    # Process webhook
    webhook_data = json.loads(payload)
    print('Webhook verified:', webhook_data)
    
    return 'OK', 200

function verifyWebhookSignature($payload, $signature, $encryptionKey) {
    // Create HMAC using your Encryption Key
    $expectedSignature = hash_hmac('sha256', $payload, $encryptionKey);
    
    // Compare signatures securely
    return hash_equals($expectedSignature, $signature);
}

// Usage in Laravel/Symfony
public function webhook(Request $request) {
    $signature = $request->header('X-Webhook-Signature');
    $payload = $request->getContent();
    
    if (!verifyWebhookSignature($payload, $signature, config('app.encryption_key'))) {
        return response('Invalid signature', 401);
    }
    
    // Process webhook
    $webhookData = json_decode($payload, true);
    Log::info('Webhook verified:', $webhookData);
    
    return response('OK', 200);
}