Webhooks

import crypto from "crypto";
import express from "express";

const app = express();

app.post(
  "/webhooks/verifyyou",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.header("X-Hub-Signature-256") || "";
    const expected = "sha256=" +
      crypto.createHmac("sha256", process.env.VERIFYYOU_WEBHOOK_SECRET)
        .update(req.body)
        .digest("hex");

    if (
      !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
    ) {
      return res.status(401).send("invalid signature");
    }

    const payload = JSON.parse(req.body.toString("utf8"));
    res.sendStatus(200);
  }
);

import crypto from "crypto";
import express, { Request, Response } from "express";

const app = express();

app.post(
  "/webhooks/verifyyou",
  express.raw({ type: "application/json" }),
  (req: Request, res: Response) => {
    const signature = req.header("X-Hub-Signature-256") ?? "";
    const expected = "sha256=" +
      crypto.createHmac("sha256", process.env.VERIFYYOU_WEBHOOK_SECRET ?? "")
        .update(req.body as Buffer)
        .digest("hex");

    if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
      return res.status(401).send("invalid signature");
    }

    const payload = JSON.parse((req.body as Buffer).toString("utf8"));
    res.sendStatus(200);
  }
);

import hmac
import hashlib
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/verifyyou")
def verifyyou_webhook():
    signature = request.headers.get("X-Hub-Signature-256", "")
    expected = "sha256=" + hmac.new(
        key=bytes(os.environ["VERIFYYOU_WEBHOOK_SECRET"], "utf-8"),
        msg=request.get_data(),
        digestmod=hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        abort(401)

    payload = request.get_json()
    return "", 200

<?php
$raw = file_get_contents("php://input");
$signature = $_SERVER["HTTP_X_HUB_SIGNATURE_256"] ?? "";
$secret = getenv("VERIFYYOU_WEBHOOK_SECRET");
$expected = "sha256=" . hash_hmac("sha256", $raw, $secret);

if (!hash_equals($signature, $expected)) {
  http_response_code(401);
  exit("invalid signature");
}

$payload = json_decode($raw, true);
http_response_code(200);

require "openssl"

raw = request.raw_post
signature = request.headers["X-Hub-Signature-256"].to_s
secret = ENV.fetch("VERIFYYOU_WEBHOOK_SECRET")
expected = "sha256=" + OpenSSL::HMAC.hexdigest("SHA256", secret, raw)

unless ActiveSupport::SecurityUtils.secure_compare(signature, expected)
  head :unauthorized and return
end

payload = JSON.parse(raw)
head :ok

package main

import (
  "crypto/hmac"
  "crypto/sha256"
  "encoding/hex"
  "io"
  "net/http"
)

func handler(w http.ResponseWriter, r *http.Request) {
  raw, _ := io.ReadAll(r.Body)
  signature := r.Header.Get("X-Hub-Signature-256")
  mac := hmac.New(sha256.New, []byte(os.Getenv("VERIFYYOU_WEBHOOK_SECRET")))
  mac.Write(raw)
  expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))

  if !hmac.Equal([]byte(signature), []byte(expected)) {
    w.WriteHeader(http.StatusUnauthorized)
    return
  }

  w.WriteHeader(http.StatusOK)
}