Webhooks

const crypto = require('crypto');
const express = require('express');
const app = express();

function isValidSignature(rawBody, header, secret) {
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(header || '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post('/webhooks/c2c', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!isValidSignature(req.body, req.get('X-C2C-Signature'), process.env.C2C_SIGNING_SECRET)) {
    return res.sendStatus(401);
  }
  const event = JSON.parse(req.body.toString('utf8'));
  res.sendStatus(200);                 // acknowledge fast
  await processEventOnce(event);       // then handle idempotently (see below)
});

import hashlib, hmac, json, os
from flask import Flask, request, abort

app = Flask(__name__)

def is_valid_signature(raw_body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header or "")

@app.post("/webhooks/c2c")
def c2c_webhook():
    raw = request.get_data()  # raw bytes, before parsing
    if not is_valid_signature(raw, request.headers.get("X-C2C-Signature"), os.environ["C2C_SIGNING_SECRET"]):
        abort(401)
    event = json.loads(raw)
    process_event_once(event)  # idempotent handler
    return "", 200

<?php
$raw = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $raw, getenv('C2C_SIGNING_SECRET'));
$provided = $_SERVER['HTTP_X_C2C_SIGNATURE'] ?? '';

if (!hash_equals($expected, $provided)) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);
processEventOnce($event); // idempotent handler
http_response_code(200);

app.MapPost("/webhooks/c2c", async (HttpRequest request, IConfiguration config) =>
{
    using var ms = new MemoryStream();
    await request.Body.CopyToAsync(ms);
    var raw = ms.ToArray();

    var secret = Encoding.UTF8.GetBytes(config["C2C:SigningSecret"]!);
    var expected = Encoding.UTF8.GetBytes("sha256=" + Convert.ToHexString(HMACSHA256.HashData(secret, raw)).ToLowerInvariant());
    var provided = Encoding.UTF8.GetBytes(request.Headers["X-C2C-Signature"].ToString());

    if (expected.Length != provided.Length || !CryptographicOperations.FixedTimeEquals(expected, provided))
        return Results.Unauthorized();

    var evt = JsonDocument.Parse(raw).RootElement;
    await ProcessEventOnceAsync(evt); // idempotent handler
    return Results.Ok();
});