Webhooks

const crypto = require("crypto");

function verifyWebhook(payload, headers, signingKey) {
  const timestamp = headers["x-webhook-timestamp"];
  const signature = headers["x-webhook-signature"];

  // Prevent replay attacks (optional: reject if > 5 minutes old)
  const eventTime = parseInt(timestamp, 10);
  const currentTime = Math.floor(Date.now() / 1000);
  if (currentTime - eventTime > 300) {
    throw new Error("Webhook timestamp too old");
  }

  // Compute expected signature
  const message = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac("sha256", signingKey)
    .update(message)
    .digest("hex");

  // Constant-time comparison
  if (
    !crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expectedSignature),
    )
  ) {
    throw new Error("Invalid webhook signature");
  }

  return JSON.parse(payload);
}

// Express.js example
app.post(
  "/webhooks/snippe",
  express.raw({ type: "application/json" }),
  (req, res) => {
    try {
      const event = verifyWebhook(
        req.body.toString(),
        req.headers,
        process.env.SNIPPE_WEBHOOK_SECRET,
      );

      // Process the event
      switch (event.type) {
        case "payment.completed":
          handlePaymentCompleted(event.data);
          break;
        case "payment.failed":
          handlePaymentFailed(event.data);
          break;
        // ... other events
      }

      res.status(200).send("OK");
    } catch (err) {
      console.error("Webhook error:", err.message);
      res.status(400).send("Invalid signature");
    }
  },
);

import hmac
import hashlib
import json
import os
import time
from flask import Flask, request, abort

app = Flask(__name__)
SIGNING_KEY = os.environ.get('SNIPPE_WEBHOOK_SECRET')

def verify_webhook(payload, headers, signing_key):
    timestamp = headers.get('X-Webhook-Timestamp')
    signature = headers.get('X-Webhook-Signature')

    # Prevent replay attacks
    event_time = int(timestamp)
    current_time = int(time.time())
    if current_time - event_time > 300:
        raise ValueError('Webhook timestamp too old')

    # Compute expected signature
    message = f"{timestamp}.{payload}"
    expected_signature = hmac.new(
        signing_key.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()

    # Constant-time comparison
    if not hmac.compare_digest(signature, expected_signature):
        raise ValueError('Invalid webhook signature')

    return json.loads(payload)

@app.route('/webhooks/snippe', methods=['POST'])
def handle_webhook():
    try:
        event = verify_webhook(
            request.data.decode(),
            request.headers,
            SIGNING_KEY
        )

        event_type = event.get('type')

        if event_type == 'payment.completed':
            handle_payment_completed(event['data'])
        elif event_type == 'payment.failed':
            handle_payment_failed(event['data'])
        # ... other events

        return 'OK', 200
    except ValueError as e:
        print(f'Webhook error: {e}')
        abort(400)

<?php
function verifyWebhook($payload, $headers, $signingKey) {
    $timestamp = $headers['X-Webhook-Timestamp'] ?? '';
    $signature = $headers['X-Webhook-Signature'] ?? '';

    // Prevent replay attacks
    $eventTime = intval($timestamp);
    $currentTime = time();
    if ($currentTime - $eventTime > 300) {
        throw new Exception('Webhook timestamp too old');
    }

    // Compute expected signature
    $message = "{$timestamp}.{$payload}";
    $expectedSignature = hash_hmac('sha256', $message, $signingKey);

    // Constant-time comparison
    if (!hash_equals($signature, $expectedSignature)) {
        throw new Exception('Invalid webhook signature');
    }

    return json_decode($payload, true);
}

// Usage
$payload = file_get_contents('php://input');
$headers = getallheaders();

try {
    $event = verifyWebhook($payload, $headers, $_ENV['SNIPPE_WEBHOOK_SECRET']);

    switch ($event['type']) {
        case 'payment.completed':
            handlePaymentCompleted($event['data']);
            break;
        case 'payment.failed':
            handlePaymentFailed($event['data']);
            break;
    }

    http_response_code(200);
    echo 'OK';
} catch (Exception $e) {
    http_response_code(400);
    echo 'Invalid signature';
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
    "strconv"
    "time"
)

func verifyWebhook(payload []byte, timestamp, signature, signingKey string) (map[string]interface{}, error) {
    // Prevent replay attacks
    eventTime, _ := strconv.ParseInt(timestamp, 10, 64)
    currentTime := time.Now().Unix()
    if currentTime-eventTime > 300 {
        return nil, fmt.Errorf("webhook timestamp too old")
    }

    // Compute expected signature
    message := fmt.Sprintf("%s.%s", timestamp, string(payload))
    mac := hmac.New(sha256.New, []byte(signingKey))
    mac.Write([]byte(message))
    expectedSignature := hex.EncodeToString(mac.Sum(nil))

    // Constant-time comparison
    if !hmac.Equal([]byte(signature), []byte(expectedSignature)) {
        return nil, fmt.Errorf("invalid webhook signature")
    }

    var event map[string]interface{}
    json.Unmarshal(payload, &event)
    return event, nil
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    payload, _ := io.ReadAll(r.Body)

    event, err := verifyWebhook(
        payload,
        r.Header.Get("X-Webhook-Timestamp"),
        r.Header.Get("X-Webhook-Signature"),
        os.Getenv("SNIPPE_WEBHOOK_SECRET"),
    )

    if err != nil {
        http.Error(w, "Invalid signature", http.StatusBadRequest)
        return
    }

    // Process event
    eventType := event["type"].(string)
    data := event["data"].(map[string]interface{})

    switch eventType {
    case "payment.completed":
        handlePaymentCompleted(data)
    case "payment.failed":
        handlePaymentFailed(data)
    }

    w.WriteHeader(http.StatusOK)
    w.Write([]byte("OK"))
}