Webhook security

signed_payload = "{timestamp}.{raw_json_body}"
signature = HMAC-SHA256(signed_payload, webhook_secret)
header = "sha256=" + hex(signature)

RAAS_WEBHOOK_SECRET=whsec_your_secret_here

const express = require('express');
const crypto = require('crypto');

const app = express();
app.use('/webhooks/raas-widgets', express.raw({ type: 'application/json' }));

const WEBHOOK_SECRET = process.env.RAAS_WEBHOOK_SECRET;

function verifyWebhookSignature(req) {
  const signature = req.headers['x-raas-signature'];
  const timestamp = req.headers['x-raas-timestamp'];
  const rawBody = req.body.toString();

  if (!signature || !timestamp) return false;

  const ageMs = Math.abs(Date.now() - parseInt(timestamp, 10) * 1000);
  if (ageMs > 5 * 60 * 1000) return false;

  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  const received = signature.replace('sha256=', '');
  try {
    return crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  } catch {
    return false;
  }
}

app.post('/webhooks/raas-widgets', (req, res) => {
  if (!verifyWebhookSignature(req)) {
    return res.status(401).send('Invalid signature');
  }
  const event = JSON.parse(req.body.toString());
  res.status(200).send('OK');
  // process event asynchronously…
});

import hmac
import hashlib
import os
import time
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = os.environ['RAAS_WEBHOOK_SECRET']

def verify_webhook_signature(req) -> bool:
    signature = req.headers.get('X-RAAS-Signature', '')
    timestamp = req.headers.get('X-RAAS-Timestamp', '')
    raw_body = req.get_data(as_text=True)
    if not signature or not timestamp:
        return False
    if abs(time.time() - int(timestamp)) > 5 * 60:
        return False
    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        f'{timestamp}.{raw_body}'.encode(),
        hashlib.sha256,
    ).hexdigest()
    received = signature.replace('sha256=', '')
    return hmac.compare_digest(received, expected)

@app.post('/webhooks/raas-widgets')
def handle_webhook():
    if not verify_webhook_signature(request):
        abort(401)
    return 'OK', 200