Webhooks

import { createHmac, timingSafeEqual } from 'node:crypto';

function verifyWebhook(rawBody, signatureHeader, secret) {
  // Parse header "t=1779800000,v1=abc123..."
  const parts = Object.fromEntries(
    signatureHeader.split(',').map((p) => p.split('='))
  );

  // 1. Reconstrói o HMAC esperado
  const signedPayload = `${parts.t}.${rawBody}`;
  const expected = createHmac('sha256', secret).update(signedPayload).digest('hex');

  // 2. Compara em tempo constante (evita timing attack)
  const expectedBuf = Buffer.from(expected, 'hex');
  const receivedBuf = Buffer.from(parts.v1, 'hex');
  if (expectedBuf.length !== receivedBuf.length) {
    throw new Error('Invalid signature');
  }
  if (!timingSafeEqual(expectedBuf, receivedBuf)) {
    throw new Error('Invalid signature');
  }

  // 3. Verifica janela de 5min (anti-replay)
  const timestampMs = Number(parts.t) * 1000;
  if (Date.now() - timestampMs > 5 * 60 * 1000) {
    throw new Error('Webhook expired (replay attack?)');
  }
}

// No Express:
app.post('/webhooks/realfy', express.raw({ type: 'application/json' }), (req, res) => {
  try {
    verifyWebhook(
      req.body.toString(),
      req.headers['x-realfy-signature'],
      process.env.WEBHOOK_SECRET
    );
  } catch (err) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body.toString());
  console.log('Webhook validated:', event.event, event.data);
  res.status(200).send('OK');
});

import hmac, hashlib, time

def verify_webhook(raw_body: bytes, signature_header: str, secret: str):
    # Parse "t=1779800000,v1=abc123..."
    parts = dict(p.split('=') for p in signature_header.split(','))

    # 1. Reconstrói o HMAC esperado
    signed_payload = f"{parts['t']}.{raw_body.decode()}"
    expected = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    # 2. Compara em tempo constante
    if not hmac.compare_digest(expected, parts['v1']):
        raise ValueError('Invalid signature')

    # 3. Anti-replay (janela 5min)
    if abs(time.time() - int(parts['t'])) > 300:
        raise ValueError('Webhook expired')

# No Flask:
from flask import Flask, request, abort
app = Flask(__name__)

@app.post('/webhooks/realfy')
def receive():
    try:
        verify_webhook(
            request.data,
            request.headers['X-Realfy-Signature'],
            os.environ['WEBHOOK_SECRET']
        )
    except ValueError:
        abort(401)

    event = request.get_json()
    print('Webhook OK:', event['event'])
    return 'OK'

<?php
function verifyWebhook(string $rawBody, string $signatureHeader, string $secret): void {
    parse_str(str_replace(',', '&', $signatureHeader), $parts);

    // 1. HMAC esperado
    $signedPayload = $parts['t'] . '.' . $rawBody;
    $expected = hash_hmac('sha256', $signedPayload, $secret);

    // 2. Compara em tempo constante
    if (!hash_equals($expected, $parts['v1'])) {
        throw new Exception('Invalid signature');
    }

    // 3. Janela 5min
    if (abs(time() - intval($parts['t'])) > 300) {
        throw new Exception('Webhook expired');
    }
}

// Em PHP puro:
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_REALFY_SIGNATURE'] ?? '';

try {
    verifyWebhook($rawBody, $signature, getenv('WEBHOOK_SECRET'));
} catch (Exception $e) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
error_log('Webhook OK: ' . $event['event']);
echo 'OK';