Verify webhook signatures

import crypto from "node:crypto";
import express from "express";

const app = express();
const secret = process.env.BRUDCAST_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 24 * 60 * 60;

// express.raw() keeps the body as a Buffer, exactly as it was sent.
app.post(
  "/webhooks/brudcast",
  express.raw({ type: "application/json" }),
  (req, res) => {
    if (!Buffer.isBuffer(req.body)) {
      return res.status(400).send("Expected a JSON body");
    }

    const expected = crypto
      .createHmac("sha256", secret)
      .update(req.body)
      .digest("hex");
    const received = req.get("X-Webhook-Signature") ?? "";

    const a = Buffer.from(expected, "utf8");
    const b = Buffer.from(received, "utf8");
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).send("Invalid signature");
    }

    const event = JSON.parse(req.body.toString("utf8"));
    const age = Math.abs(Date.now() / 1000 - event.timestamp);
    if (age > TOLERANCE_SECONDS) {
      return res.status(400).send("Stale delivery");
    }

    // Store the event, keyed by event.delivery_id, and skip it if it's already there.
    res.sendStatus(200);
  },
);

app.listen(3000);

import hashlib
import hmac
import json
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["BRUDCAST_WEBHOOK_SECRET"].encode("utf-8")
TOLERANCE_SECONDS = 24 * 60 * 60


@app.post("/webhooks/brudcast")
def brudcast_webhook():
    raw_body = request.get_data()  # the exact bytes that were sent

    expected = hmac.new(SECRET, raw_body, hashlib.sha256).hexdigest()
    received = request.headers.get("X-Webhook-Signature", "")

    if not hmac.compare_digest(expected.encode("utf-8"), received.encode("utf-8")):
        abort(401)

    event = json.loads(raw_body)
    if abs(time.time() - event["timestamp"]) > TOLERANCE_SECONDS:
        abort(400)

    # Store the event, keyed by event["delivery_id"], and skip it if it's already there.
    return "", 200

<?php
$secret = getenv('BRUDCAST_WEBHOOK_SECRET');
$toleranceSeconds = 24 * 60 * 60;

$rawBody = file_get_contents('php://input'); // the exact bytes that were sent

$expected = hash_hmac('sha256', $rawBody, $secret);
$received = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
if (!is_array($event) || abs(time() - (int) $event['timestamp']) > $toleranceSeconds) {
    http_response_code(400);
    exit('Stale delivery');
}

// Store the event, keyed by $event['delivery_id'], and skip it if it's already there.
http_response_code(200);

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"log"
	"net/http"
	"os"
	"time"
)

const toleranceSeconds = 24 * 60 * 60

type webhookEvent struct {
	DeliveryID string          `json:"delivery_id"`
	Event      string          `json:"event"`
	Data       json.RawMessage `json:"data"`
	Timestamp  int64           `json:"timestamp"`
}

func brudcastWebhook(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
		return
	}

	body, err := io.ReadAll(r.Body) // the exact bytes that were sent
	if err != nil {
		http.Error(w, "cannot read body", http.StatusBadRequest)
		return
	}

	mac := hmac.New(sha256.New, []byte(os.Getenv("BRUDCAST_WEBHOOK_SECRET")))
	mac.Write(body)
	expected := hex.EncodeToString(mac.Sum(nil))
	received := r.Header.Get("X-Webhook-Signature")

	if !hmac.Equal([]byte(expected), []byte(received)) {
		http.Error(w, "invalid signature", http.StatusUnauthorized)
		return
	}

	var event webhookEvent
	if err := json.Unmarshal(body, &event); err != nil {
		http.Error(w, "invalid JSON", http.StatusBadRequest)
		return
	}

	age := time.Now().Unix() - event.Timestamp
	if age > toleranceSeconds || age < -toleranceSeconds {
		http.Error(w, "stale delivery", http.StatusBadRequest)
		return
	}

	// Store the event, keyed by event.DeliveryID, and skip it if it's already there.
	w.WriteHeader(http.StatusOK)
}

func main() {
	http.HandleFunc("/webhooks/brudcast", brudcastWebhook)
	log.Fatal(http.ListenAndServe(":3000", nil))
}