Webhooks

const express = require("express");
const crypto = require("crypto");

const app = express();
app.use(express.json({ verify: (req, res, buf) => { req.rawBody = buf } }));

const WEHO_SECRET = "whsec_XI+NCZLEYIveyE9JlGzrNz0uin0MW0hU9Ldb9kn+GPGuHEs1huWsov67uqmtUz9fRrgpLLeQwE2+rwv8dF/DJw";
const TIMESTAMP_TOLERANCE = 5 * 60;

app.post("/webhook", (req, res) => {
  console.log("Raw payload:", req.rawBody.toString());
  const signatureHeader = req.headers["webhook-signature"];
  const timestamp = req.headers["webhook-timestamp"];
  const deliveryId = req.headers["webhook-id"];

  console.log("signatureHeader:", signatureHeader);
  console.log("timestamp:", timestamp);
  console.log("deliveryId:", deliveryId);

  if (!signatureHeader || !timestamp || !deliveryId) {
    return res.status(400).send("Missing one of required headers: webhook-id, webhook-timestamp, webhook-signature");
  }

  if (!signatureHeader.startsWith("v1=")) {
    return res.status(400).send("Invalid signature format");
  }
  const receivedSig = signatureHeader.split("=", 2)[1];

  const ts = parseInt(timestamp, 10);
  if (isNaN(ts)) {
    return res.status(400).send("Invalid webhook-timestamp");
  }

  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - ts) > TIMESTAMP_TOLERANCE) {
    return res.status(400).send("Webhook timestamp outside of tolerance window");
  }

  const signedPayload = Buffer.concat([
    Buffer.from(timestamp, "utf8"),
    req.rawBody
  ]);

  const computedHmac = crypto
    .createHmac("sha256", WEHO_SECRET)
    .update(signedPayload)
    .digest("hex");

  const isValid = crypto.timingSafeEqual(
    Buffer.from(computedHmac),
    Buffer.from(receivedSig)
  );

  if (!isValid) {
    return res.status(401).send("Invalid signature");
  }

  console.log("Payload:", req.body);
  console.info("✔️ Received valid webhook ", deliveryId, req.body);

  res.json({ status: "ok" });
});

app.listen(4422, "127.0.0.1", () => {
  console.log("Webhook server running on http://127.0.0.1:4422");
});

require 'webrick'
require 'openssl'
require 'json'
require 'time'

WEHO_SECRET = 'whsec_zQtx6pI1m/i6j4Hi2A8ukDlaJUNYtG1Jqm+OH9FLvn8Juf/RzD3oABtBfJrGw4c17J4PXjri4GF2h1NZBc78aA'
TIMESTAMP_TOLERANCE = 5 * 60 # 5 minutes

server = WEBrick::HTTPServer.new(Port: 4424)

server.mount_proc '/webhook' do |req, res|
  raw_body = req.body
  headers = req.header.transform_keys(&:downcase)

  signature_header = headers["webhook-signature"]&.first || ""
  timestamp = headers["webhook-timestamp"]&.first || ""
  delivery_id = headers["webhook-id"]&.first || ""

  puts "signatureHeader: #{signature_header}"
  puts "timestamp: #{timestamp}"
  puts "deliveryId: #{delivery_id}"

  if signature_header.empty? || timestamp.empty? || delivery_id.empty?
    res.status = 400
    res.body = "Missing one of required headers: webhook-id, webhook-timestamp, webhook-signature"
    next
  end

  unless signature_header.start_with?("v1=")
    res.status = 400
    res.body = "Invalid signature format"
    next
  end

  received_sig = signature_header[3..]
  ts = timestamp.to_i

  if ts == 0
    res.status = 400
    res.body = "Invalid webhook-timestamp"
    next
  end

  now = Time.now.to_i
  if (now - ts).abs > TIMESTAMP_TOLERANCE
    res.status = 400
    res.body = "Webhook timestamp outside of tolerance window"
    next
  end

  signed_payload = timestamp + raw_body
  computed_hmac = OpenSSL::HMAC.hexdigest('sha256', WEHO_SECRET, signed_payload)

  # For security reasons, use secure compare
  unless Rack::Utils.secure_compare(computed_hmac, received_sig)
    res.status = 401
    res.body = "Invalid signature"
    next
  end

  payload = JSON.parse(raw_body) rescue {}
  puts "Payload: #{payload}"
  puts "✔️ Received valid webhook #{delivery_id}"

  res['Content-Type'] = 'application/json'
  res.body = { status: 'ok' }.to_json
end

trap("INT") { server.shutdown }
server.start

#!/usr/bin/env python3
import os
import hmac
import hashlib
import time
from flask import Flask, request, abort, jsonify

app = Flask(__name__)

# The webhook secret
WEHO_SECRET = "whsec_TJWDeK/U/JIDtD8Z9VJ00zsqjE7S/fwV47BTg4/hqO+2yi0PcHjaurd0C7S6kbsGwxeo/fX1+E0hjN+QkIHmNg"

TIMESTAMP_TOLERANCE = 5 * 60

@app.route("/webhook", methods=["POST"])
def receive_webhook():
    # 1. Extract headers
    signature_header = request.headers.get("webhook-signature", "")
    print(signature_header)
    timestamp = request.headers.get("webhook-timestamp", "")
    print(timestamp)
    delivery_id = request.headers.get("webhook-id", "")
    print(delivery_id)

    if not signature_header or not timestamp or not delivery_id:
        abort(400, "Missing one of required headers: webhook-id, webhook-timestamp, webhook-signature")

    # 2. Verify signature format
    if not signature_header.startswith("v1="):
        abort(400, "Invalid signature format")
    received_sig = signature_header.split("=", 1)[1]

    # 3. Prevent replay by ensuring timestamp is recent
    try:
        ts = int(timestamp)
    except ValueError:
        abort(400, "Invalid webhook-timestamp")
    now = int(time.time())
    if abs(now - ts) > TIMESTAMP_TOLERANCE:
        abort(400, "Webhook timestamp outside of tolerance window")

    # 4. Compute our own HMAC-SHA256 over timestamp + raw body
    payload = request.get_data()  # raw bytes
    signed_payload = timestamp.encode("utf-8") + payload
    print(signed_payload)
    computed_hmac = hmac.new(
        key=WEHO_SECRET.encode("utf-8"),
        msg=signed_payload,
        digestmod=hashlib.sha256
    ).hexdigest()

    # 5. Constant-time compare
    if not hmac.compare_digest(computed_hmac, received_sig):
        abort(401, "Invalid signature")

    # 6. At this point the payload is verified
    data = request.get_json(silent=True) or {}
    print(data)
    app.logger.info(f"✔️ Received valid webhook {delivery_id}: %s", data)

    return jsonify({"status": "ok"}), 200

if __name__ == "__main__":
    # Listen on all interfaces (127.0.0.1) at port 4422
    app.run(host="127.0.0.1", port=4422)