Webhook Verification

const crypto = require('crypto');

function verifyWebhookSignature(rawBody, signatureHeader, secret) {
  const signature = (signatureHeader || '').replace('sha256=', '');
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody, 'utf8')
    .digest('hex');

  try {
    return crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expected)
    );
  } catch {
    return false;
  }
}

// Express.js: use the raw body, not the parsed JSON
app.post('/webhooks/daya-coins', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body.toString('utf8');
  if (!verifyWebhookSignature(rawBody, req.headers['x-webhook-signature'], process.env.DAYA_COINS_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(rawBody);
  res.status(200).send('OK');
});

import hmac
import hashlib

def verify_webhook_signature(raw_body: bytes, signature_header: str, secret: str) -> bool:
    signature = (signature_header or '').replace('sha256=', '')
    expected = hmac.new(
        secret.encode('utf-8'),
        raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

# Flask: read the raw body, not request.json
from flask import Flask, request, jsonify

@app.route('/webhooks/daya-coins', methods=['POST'])
def handle_webhook():
    raw_body = request.get_data()
    if not verify_webhook_signature(raw_body, request.headers.get('X-Webhook-Signature', ''), DAYA_COINS_WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401

    event = request.get_json()
    return jsonify({'status': 'ok'}), 200

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "strings"
)

func verifyWebhookSignature(rawBody []byte, signatureHeader, secret string) bool {
    signature := strings.TrimPrefix(signatureHeader, "sha256=")
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(rawBody)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signature), []byte(expected))
}

func handleWebhook(w http.ResponseWriter, r *http.Request) {
    rawBody, _ := io.ReadAll(r.Body)
    if !verifyWebhookSignature(rawBody, r.Header.Get("X-Webhook-Signature"), dayaCoinsWebhookSecret) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    // Parse rawBody and handle the event...
    w.WriteHeader(http.StatusOK)
}