Webhooks

#!/bin/bash

PAYLOAD='<Webhook HTTP request body>'
BASE64_SECRET='<Your webhook secret>'
PROVIDED_SIG='sha256=... <signature from request header>'

CALCULATED=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$(echo -n "$BASE64_SECRET" | base64 -d)" | cut -d' ' -f2)
EXPECTED=$(echo "$PROVIDED_SIG" | cut -d'=' -f2)

echo "Calculated: $CALCULATED"
echo "Expected  : $EXPECTED"

if [ "$CALCULATED" = "$EXPECTED" ]; then
    echo "Valid"
else  
    echo "Invalid"
fi

[HttpPost]
public IActionResult Webhook([FromBody] string payload)
{
    string signature = Request.Headers["X-Volley-Signature"];
    string secret = Configuration["WebhookSecret"]; // This should be the HMAC secret I gave you
    
    if (WebhookValidator.ValidateWebhook(payload, secret, signature))
    {
        // Process webhook
        return Ok();
    }
    
    return Unauthorized();
}

public static class WebhookValidator
{
    public static bool ValidateWebhook(string payload, string base64Secret, string providedSignature)
    {
        try
        {
            byte[] secretKey = Convert.FromBase64String(base64Secret);
            
            using (var hmac = new HMACSHA256(secretKey))
            {
                byte[] payloadBytes = Encoding.UTF8.GetBytes(payload);
                byte[] hash = hmac.ComputeHash(payloadBytes);
                string calculated = Convert.ToHexString(hash).ToLowerInvariant();
                
                string expected = providedSignature.StartsWith("sha256=") 
                    ? providedSignature.Substring(7) 
                    : providedSignature;
                
                return calculated == expected;
            }
        }
        catch
        {
            return false;
        }
    }
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	body, _ := io.ReadAll(r.Body)
	payload := string(body)
	
	signature := r.Header.Get("X-Volley-Signature")
	secret := os.Getenv("WEBHOOK_SECRET") // Base64 encoded HMAC secret
	
	if validateWebhook(payload, secret, signature) {
		// Process webhook
		processWebhook(payload)
		w.WriteHeader(http.StatusOK)
		return
	}
	
	w.WriteHeader(http.StatusUnauthorized)
}

func validateWebhook(payload, base64Secret, providedSignature string) bool {
	secretKey, err := base64.StdEncoding.DecodeString(base64Secret)
	if err != nil {
		return false
	}
	
	h := hmac.New(sha256.New, secretKey)
	h.Write([]byte(payload))
	calculated := hex.EncodeToString(h.Sum(nil))
	
	expected := providedSignature
	if strings.HasPrefix(providedSignature, "sha256=") {
		expected = providedSignature[7:]
	}
	
	return hmac.Equal([]byte(calculated), []byte(expected))
}

func processWebhook(payload string) {
	// TODO: Add your webhook processing logic here
	println("Processing webhook:", payload)
}

class WebhookController < ApplicationController
  skip_before_action :verify_authenticity_token
  
  def receive
    payload = request.body.read
    signature = request.headers['X-Volley-Signature']
    secret = ENV['WEBHOOK_SECRET'] # Base64 encoded HMAC secret
    
    if WebhookValidator.validate(payload, secret, signature)
      # Process webhook
      process_webhook(payload)
      head :ok
    else
      head :unauthorized
    end
  end
  
  private
  
  def process_webhook(payload)
    # TODO: Add your webhook processing logic here
    Rails.logger.info "Processing webhook: #{payload}"
  end
end

class WebhookValidator
  def self.validate(payload, base64_secret, provided_signature)
    return false if base64_secret.nil? || provided_signature.nil?
    
    begin
      secret_key = Base64.decode64(base64_secret)
      calculated = OpenSSL::HMAC.hexdigest('sha256', secret_key, payload)
      
      expected = provided_signature.start_with?('sha256=') ? 
                 provided_signature[7..-1] : 
                 provided_signature
      
      OpenSSL.fixed_length_secure_compare(calculated, expected)
    rescue
      false
    end
  end
end

const express = require('express');
const crypto = require('crypto');

const app = express();

// Middleware to get raw body for signature verification
app.use('/webhook', express.raw({ type: 'application/json' }));

app.post('/webhook', (req, res) => {
  const payload = req.body.toString();
  const signature = req.headers['x-volley-signature'];
  const secret = process.env.WEBHOOK_SECRET; // Base64 encoded HMAC secret
  
  if (validateWebhook(payload, secret, signature)) {
    // Process webhook
    processWebhook(payload);
    res.status(200).send('OK');
  } else {
    res.status(401).send('Unauthorized');
  }
});

function validateWebhook(payload, base64Secret, providedSignature) {
  if (!base64Secret || !providedSignature) return false;
  
  try {
    const secretKey = Buffer.from(base64Secret, 'base64');
    const calculated = crypto.createHmac('sha256', secretKey)
                           .update(payload, 'utf8')
                           .digest('hex');
    
    const expected = providedSignature.startsWith('sha256=') ? 
                     providedSignature.substring(7) : 
                     providedSignature;
    
    return crypto.timingSafeEqual(Buffer.from(calculated), Buffer.from(expected));
  } catch {
    return false;
  }
}

function processWebhook(payload) {
  // TODO: Add your webhook processing logic here
  console.log('Processing webhook:', payload);
}