Webhooks

import hashlib, hmac, time
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = "whsec_your_secret_here"
MAX_AGE_SECONDS = 300  # Reject deliveries older than 5 minutes

def verify_webhook(payload: bytes, signature_header: str, secret: str) -> bool:
    """Verify a Danube webhook signature with replay protection.

    Signature format: t={unix_timestamp},sha256={hex_digest}
    Signed content:   {timestamp}.{payload}
    """
    parts = dict(p.split("=", 1) for p in signature_header.split(",") if "=" in p)
    ts = parts.get("t", "")
    sig = parts.get("sha256", "")

    if not ts or not sig:
        return False

    # Reject old deliveries to prevent replay attacks
    if abs(time.time() - int(ts)) > MAX_AGE_SECONDS:
        return False

    signed_content = f"{ts}.{payload.decode()}"
    expected = hmac.new(
        secret.encode(), signed_content.encode(), hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(expected, sig)

@app.route("/webhooks/danube", methods=["POST"])
def handle_webhook():
    payload = request.data
    signature = request.headers.get("X-Danube-Signature", "")

    if not verify_webhook(payload, signature, WEBHOOK_SECRET):
        abort(401)

    event = request.json
    print(f"{event['event']}: {event['data']}")
    return "", 200

const crypto = require('crypto');
const express = require('express');
const app = express();

const WEBHOOK_SECRET = 'whsec_your_secret_here';
const MAX_AGE_SECONDS = 300; // Reject deliveries older than 5 minutes

function verifyWebhook(payload, signatureHeader, secret) {
  // Signature format: t={unix_timestamp},sha256={hex_digest}
  const parts = Object.fromEntries(
    signatureHeader.split(',').map(p => p.split('=', 2))
  );
  const ts = parts.t;
  const sig = parts.sha256;

  if (!ts || !sig) return false;

  // Reject old deliveries to prevent replay attacks
  if (Math.abs(Date.now() / 1000 - parseInt(ts)) > MAX_AGE_SECONDS) {
    return false;
  }

  const signedContent = `${ts}.${payload}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(signedContent, 'utf-8')
    .digest('hex');

  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}

app.post('/webhooks/danube',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const payload = req.body.toString();
    const signature = req.headers['x-danube-signature'] || '';

    if (!verifyWebhook(payload, signature, WEBHOOK_SECRET)) {
      return res.status(401).send('Invalid signature');
    }

    const event = JSON.parse(payload);
    console.log(`${event.event}:`, event.data);
    res.sendStatus(200);
  }
);

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "math"
    "net/http"
    "strconv"
    "strings"
    "time"
)

const webhookSecret = "whsec_your_secret_here"
const maxAgeSeconds = 300

func verifyWebhook(body []byte, signatureHeader, secret string) bool {
    // Parse "t={ts},sha256={hex}"
    parts := make(map[string]string)
    for _, segment := range strings.Split(signatureHeader, ",") {
        kv := strings.SplitN(segment, "=", 2)
        if len(kv) == 2 {
            parts[kv[0]] = kv[1]
        }
    }

    ts, hasTsm := parts["t"]
    sig, hasSig := parts["sha256"]
    if !hasTsm || !hasSig {
        return false
    }

    // Replay protection
    tsInt, err := strconv.ParseInt(ts, 10, 64)
    if err != nil || math.Abs(float64(time.Now().Unix()-tsInt)) > maxAgeSeconds {
        return false
    }

    signedContent := ts + "." + string(body)
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(signedContent))
    expected := hex.EncodeToString(mac.Sum(nil))

    return hmac.Equal([]byte(expected), []byte(sig))
}

func handler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    signature := r.Header.Get("X-Danube-Signature")

    if !verifyWebhook(body, signature, webhookSecret) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    var event map[string]interface{}
    json.Unmarshal(body, &event)
    fmt.Printf("%s: %v\n", event["event"], event["data"])
    w.WriteHeader(http.StatusOK)
}