Webhooks

import crypto from 'crypto';

function verifyWebhookSignature(
  payload: string,
  signature: string,
  timestamp: string,
  secret: string
): boolean {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`)
    .digest('hex');

  // Remove 'v1=' prefix from signature
  const receivedSignature = signature.replace('v1=', '');

  return crypto.timingSafeEqual(
    Buffer.from(expectedSignature),
    Buffer.from(receivedSignature)
  );
}

app.post('/webhooks/paytrie', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-paytrie-signature'];
  const timestamp = req.headers['x-paytrie-timestamp'];
  const payload = req.body.toString();

  if (!verifyWebhookSignature(payload, signature, timestamp, process.env.PAYTRIE_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // Process the webhook
  const event = JSON.parse(payload);
  console.log('Received webhook:', event);

  res.status(200).send('OK');
});

import hmac
import hashlib
from flask import Flask, request

def verify_webhook_signature(payload: str, signature: str, timestamp: str, secret: str) -> bool:
    expected_signature = hmac.new(
        secret.encode(),
        f"{timestamp}.{payload}".encode(),
        hashlib.sha256
    ).hexdigest()

    # Remove 'v1=' prefix from signature
    received_signature = signature.replace('v1=', '')

    return hmac.compare_digest(expected_signature, received_signature)

@app.route('/webhooks/paytrie', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Paytrie-Signature')
    timestamp = request.headers.get('X-Paytrie-Timestamp')
    payload = request.get_data(as_text=True)

    if not verify_webhook_signature(payload, signature, timestamp, PAYTRIE_WEBHOOK_SECRET):
        return 'Invalid signature', 401

    # Process the webhook
    event = request.get_json()
    print('Received webhook:', event)

    return 'OK', 200

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"net/http"
	"strings"
)

func verifyWebhookSignature(payload, signature, timestamp, secret string) bool {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(timestamp + "." + payload))
	expectedSignature := hex.EncodeToString(mac.Sum(nil))

	// Remove 'v1=' prefix from signature
	receivedSignature := strings.TrimPrefix(signature, "v1=")

	return hmac.Equal([]byte(expectedSignature), []byte(receivedSignature))
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	signature := r.Header.Get("X-Paytrie-Signature")
	timestamp := r.Header.Get("X-Paytrie-Timestamp")

	body, _ := io.ReadAll(r.Body)
	payload := string(body)

	if !verifyWebhookSignature(payload, signature, timestamp, paytrieWebhookSecret) {
		http.Error(w, "Invalid signature", http.StatusUnauthorized)
		return
	}

	// Process the webhook
	w.WriteHeader(http.StatusOK)
}

require 'openssl'

def verify_webhook_signature(payload, signature, timestamp, secret)
  expected_signature = OpenSSL::HMAC.hexdigest('sha256', secret, "#{timestamp}.#{payload}")

  # Remove 'v1=' prefix from signature
  received_signature = signature.sub('v1=', '')

  ActiveSupport::SecurityUtils.secure_compare(expected_signature, received_signature)
end

# Rails example
class WebhooksController < ApplicationController
  skip_before_action :verify_authenticity_token

  def paytrie
    signature = request.headers['X-Paytrie-Signature']
    timestamp = request.headers['X-Paytrie-Timestamp']
    payload = request.raw_post

    unless verify_webhook_signature(payload, signature, timestamp, ENV['PAYTRIE_WEBHOOK_SECRET'])
      return head :unauthorized
    end

    # Process the webhook
    event = JSON.parse(payload)
    Rails.logger.info("Received webhook: #{event}")

    head :ok
  end
end