Webhooks

import crypto from 'crypto';

function verifyWebhook(payload, headers, secret) {
  const msgId = headers['webhook-id'];
  const timestamp = headers['webhook-timestamp'];
  const signatures = headers['webhook-signature'];

  if (!msgId || !timestamp || !signatures) {
    throw new Error('Missing required webhook headers');
  }

  // Reject timestamps older than 5 minutes
  const tolerance = 5 * 60; // seconds
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp, 10)) > tolerance) {
    throw new Error('Webhook timestamp outside tolerance');
  }

  // Build signing base
  const signedContent = `${msgId}.${timestamp}.${payload}`;

  // Decode secret (remove "whsec_" prefix, base64 decode the rest)
  const secretBytes = Buffer.from(secret.split('_')[1], 'base64');

  // Compute expected signature
  const expected = crypto
    .createHmac('sha256', secretBytes)
    .update(signedContent)
    .digest('base64');

  // Check against all provided signatures (constant-time to prevent timing attacks)
  const expectedBuf = Buffer.from(expected, 'base64');
  const valid = signatures.split(' ').some((sig) => {
    const parts = sig.split(',', 2);
    if (parts.length !== 2) return false;
    const receivedBuf = Buffer.from(parts[1], 'base64');
    return expectedBuf.length === receivedBuf.length &&
      crypto.timingSafeEqual(expectedBuf, receivedBuf);
  });

  if (!valid) {
    throw new Error('Invalid webhook signature');
  }

  return JSON.parse(payload);
}

// Express example
app.post(
  '/webhooks/miracle',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    try {
      const body = verifyWebhook(
        req.body.toString(),
        req.headers,
        process.env.WEBHOOK_SECRET
      );

      // Events are wrapped in { events: [event] }
      for (const event of body.events) {
        switch (event.type) {
          case 'payment.succeeded':
            // Fulfill the order
            break;
          case 'payment.failed':
            // Notify the customer
            break;
        }
      }

      res.status(200).send('OK');
    } catch (err) {
      console.error('Webhook verification failed:', err.message);
      res.status(400).send('Invalid signature');
    }
  }
);

import hashlib
import hmac
import base64
import json
import time


def verify_webhook(payload: str, headers: dict, secret: str) -> dict:
    msg_id = headers.get("webhook-id")
    timestamp = headers.get("webhook-timestamp")
    signatures = headers.get("webhook-signature")

    if not msg_id or not timestamp or not signatures:
        raise ValueError("Missing required webhook headers")

    # Reject timestamps older than 5 minutes
    tolerance = 5 * 60  # seconds
    now = int(time.time())
    if abs(now - int(timestamp)) > tolerance:
        raise ValueError("Webhook timestamp outside tolerance")

    # Build signing base
    signed_content = f"{msg_id}.{timestamp}.{payload}"

    # Decode secret (remove "whsec_" prefix, base64 decode the rest)
    secret_bytes = base64.b64decode(secret.split("_")[1])

    # Compute expected signature
    expected = base64.b64encode(
        hmac.new(secret_bytes, signed_content.encode(), hashlib.sha256).digest()
    ).decode()

    # Check against all provided signatures
    valid = False
    for sig in signatures.split(" "):
        parts = sig.split(",", 1)
        if len(parts) == 2 and hmac.compare_digest(expected, parts[1]):
            valid = True
            break

    if not valid:
        raise ValueError("Invalid webhook signature")

    return json.loads(payload)


# Flask example
from flask import Flask, request

app = Flask(__name__)

@app.route("/webhooks/miracle", methods=["POST"])
def handle_webhook():
    try:
        body = verify_webhook(
            request.get_data(as_text=True),
            dict(request.headers),
            WEBHOOK_SECRET,
        )
    except ValueError as e:
        return str(e), 400

    # Events are wrapped in { "events": [event] }
    for event in body["events"]:
        if event["type"] == "payment.succeeded":
            # Fulfill the order
            pass
        elif event["type"] == "payment.failed":
            # Notify the customer
            pass

    return "OK", 200

<?php

function verifyWebhook(string $payload, array $headers, string $secret): array
{
    $msgId      = $headers['webhook-id'] ?? null;
    $timestamp  = $headers['webhook-timestamp'] ?? null;
    $signatures = $headers['webhook-signature'] ?? null;

    if (!$msgId || !$timestamp || !$signatures) {
        throw new \Exception('Missing required webhook headers');
    }

    // Reject timestamps older than 5 minutes
    $tolerance = 5 * 60;
    if (abs(time() - intval($timestamp)) > $tolerance) {
        throw new \Exception('Webhook timestamp outside tolerance');
    }

    // Build signing base
    $signedContent = "{$msgId}.{$timestamp}.{$payload}";

    // Decode secret (remove "whsec_" prefix, base64 decode the rest)
    $secretBytes = base64_decode(explode('_', $secret, 2)[1]);

    // Compute expected signature
    $expected = base64_encode(
        hash_hmac('sha256', $signedContent, $secretBytes, true)
    );

    // Check against all provided signatures
    $valid = false;
    foreach (explode(' ', $signatures) as $sig) {
        $parts = explode(',', $sig, 2);
        if (count($parts) === 2 && hash_equals($expected, $parts[1])) {
            $valid = true;
            break;
        }
    }

    if (!$valid) {
        throw new \Exception('Invalid webhook signature');
    }

    return json_decode($payload, true);
}

// Usage
$payload = file_get_contents('php://input');
$headers = [
    'webhook-id'        => $_SERVER['HTTP_WEBHOOK_ID'] ?? '',
    'webhook-timestamp' => $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? '',
    'webhook-signature' => $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '',
];

try {
    $body = verifyWebhook($payload, $headers, $webhookSecret);

    // Events are wrapped in { "events": [event] }
    foreach ($body['events'] as $event) {
        switch ($event['type']) {
            case 'payment.succeeded':
                // Fulfill the order
                break;
            case 'payment.failed':
                // Notify the customer
                break;
        }
    }

    http_response_code(200);
    echo 'OK';
} catch (\Exception $e) {
    http_response_code(400);
    echo $e->getMessage();
}

require "openssl"
require "base64"
require "json"

def verify_webhook(payload, headers, secret)
  msg_id     = headers["webhook-id"]
  timestamp  = headers["webhook-timestamp"]
  signatures = headers["webhook-signature"]

  unless msg_id && timestamp && signatures
    raise "Missing required webhook headers"
  end

  # Reject timestamps older than 5 minutes
  tolerance = 5 * 60 # seconds
  if (Time.now.to_i - timestamp.to_i).abs > tolerance
    raise "Webhook timestamp outside tolerance"
  end

  # Build signing base
  signed_content = "#{msg_id}.#{timestamp}.#{payload}"

  # Decode secret (remove "whsec_" prefix, base64 decode the rest)
  secret_bytes = Base64.decode64(secret.split("_", 2)[1])

  # Compute expected signature
  expected = Base64.strict_encode64(
    OpenSSL::HMAC.digest("sha256", secret_bytes, signed_content)
  )

  # Check against all provided signatures
  valid = signatures.split(" ").any? do |sig|
    parts = sig.split(",", 2)
    parts.length == 2 && OpenSSL.fixed_length_secure_compare(expected, parts[1])
  end

  raise "Invalid webhook signature" unless valid

  JSON.parse(payload)
end

# Sinatra example
require "sinatra"

post "/webhooks/miracle" do
  payload = request.body.read

  begin
    body = verify_webhook(
      payload,
      {
        "webhook-id"        => request.env["HTTP_WEBHOOK_ID"],
        "webhook-timestamp" => request.env["HTTP_WEBHOOK_TIMESTAMP"],
        "webhook-signature" => request.env["HTTP_WEBHOOK_SIGNATURE"]
      },
      ENV["WEBHOOK_SECRET"]
    )
  rescue => e
    halt 400, e.message
  end

  # Events are wrapped in { "events" => [event] }
  body["events"].each do |event|
    case event["type"]
    when "payment.succeeded"
      # Fulfill the order
    when "payment.failed"
      # Notify the customer
    end
  end

  status 200
  "OK"
end