Webhooks

// Express: verify before parsing. The signature covers the RAW body.
import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

function verifyWebhook(rawBody, header, secret, tolerance = 300) {
  const parts = (header ?? '').split(',').map((p) => p.trim().split('='));
  const t = Number(parts.find(([k]) => k === 't')?.[1]);
  const sigs = parts.filter(([k]) => k === 'v1').map(([, v]) => Buffer.from(v ?? '', 'hex'));
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > tolerance) throw new Error('stale or malformed signature');
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  if (!sigs.some((s) => s.length === expected.length && timingSafeEqual(s, expected))) throw new Error('bad signature');
  return JSON.parse(rawBody);
}

const app = express();
app.post('/hooks/vouchereto', express.raw({ type: 'application/json' }), async (req, res) => {
  let event;
  try { event = verifyWebhook(req.body.toString('utf8'), req.get('Vouchereto-Signature'), process.env.VOUCHERETO_WEBHOOK_SECRET); }
  catch { return res.sendStatus(400); }
  // Deliveries can repeat: skip events you already processed (event.id === Vouchereto-Event-Id header)
  // if (await seen(event.id)) return res.sendStatus(200);
  if (event.type === 'redemption.captured') { /* credit event.data.customer_ref with event.data.amount_minor */ }
  res.sendStatus(200);                       // answer within 10 s; do slow work in a queue
});

# Flask: verify before parsing. The signature covers the RAW body.
import hashlib, hmac, json, os, time

def verify_webhook(raw: bytes, header: str, secret: str, tolerance: int = 300) -> dict:
    items = [p.strip().split("=", 1) for p in (header or "").split(",") if "=" in p]
    t = next((int(v) for k, v in items if k == "t"), None)
    sigs = [v for k, v in items if k == "v1"]
    if t is None or abs(time.time() - t) > tolerance:
        raise ValueError("stale or malformed signature")
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    if not any(hmac.compare_digest(expected, s) for s in sigs):
        raise ValueError("bad signature")
    return json.loads(raw)

# from flask import Flask, request
# app = Flask(__name__)
# @app.post("/hooks/vouchereto")
# def hook():
#     try:
#         event = verify_webhook(request.get_data(), request.headers.get("Vouchereto-Signature"), os.environ["VOUCHERETO_WEBHOOK_SECRET"])
#     except ValueError:
#         return "", 400
#     # skip if event["id"] was already processed, then handle event["type"]
#     return "", 200

<?php
// Plain PHP: verify before parsing. The signature covers the RAW body.
function verify_webhook(string $raw, ?string $header, string $secret, int $tolerance = 300): array {
    $t = null; $sigs = [];
    foreach (explode(',', $header ?? '') as $part) {
        [$k, $v] = array_pad(explode('=', trim($part), 2), 2, '');
        if ($k === 't') $t = (int) $v;
        if ($k === 'v1') $sigs[] = $v;
    }
    if ($t === null || abs(time() - $t) > $tolerance) throw new RuntimeException('stale or malformed signature');
    $expected = hash_hmac('sha256', "$t.$raw", $secret);
    foreach ($sigs as $s) if (hash_equals($expected, $s)) return json_decode($raw, true);
    throw new RuntimeException('bad signature');
}

// $raw = file_get_contents('php://input');
// try { $event = verify_webhook($raw, $_SERVER['HTTP_VOUCHERETO_SIGNATURE'] ?? null, getenv('VOUCHERETO_WEBHOOK_SECRET')); }
// catch (RuntimeException $e) { http_response_code(400); exit; }
// // skip if $event['id'] was already processed, then handle $event['type']
// http_response_code(200);