Receiving webhooks

import hashlib
import hmac
import time
from typing import Optional


def verify_signature(secret: str, header: str, raw_body: bytes, tolerance: int = 300, now: Optional[int] = None) -> bool:
    """True when the WoodSystems-Signature header matches the raw request body.

    secret:   the endpoint's signing secret (whsec_...), from Settings, Integrations.
    header:   the WoodSystems-Signature header, t=<unix>,v1=<hex>[,v1=<hex>].
    raw_body: the request body exactly as received, before any JSON parsing.
    """
    timestamp = None
    signatures = []
    for part in header.split(","):
        key, _, value = part.strip().partition("=")
        if key == "t" and value.isdigit():
            timestamp = int(value)
        elif key == "v1" and value:
            signatures.append(value)
    if timestamp is None or not signatures:
        return False
    current = int(time.time()) if now is None else now
    if abs(current - timestamp) > tolerance:
        return False
    message = str(timestamp).encode("utf-8") + b"." + raw_body
    expected = hmac.new(secret.encode("utf-8"), message, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, signature) for signature in signatures)


# In a Flask view, for example:
#
#   if not verify_signature(os.environ["WOODSYSTEMS_WEBHOOK_SECRET"],
#                           request.headers.get("WoodSystems-Signature", ""),
#                           request.get_data()):
#       abort(400)

const crypto = require('node:crypto');

// True when the WoodSystems-Signature header matches the raw request body.
//   secret:  the endpoint's signing secret (whsec_...), from Settings, Integrations.
//   header:  the WoodSystems-Signature header, t=<unix>,v1=<hex>[,v1=<hex>].
//   rawBody: the request body exactly as received (a Buffer or string), before JSON parsing.
function verifySignature(secret, header, rawBody, toleranceSeconds = 300, now = Math.floor(Date.now() / 1000)) {
  let timestamp = null;
  const signatures = [];
  for (const part of String(header || '').split(',')) {
    const index = part.indexOf('=');
    if (index < 0) continue;
    const key = part.slice(0, index).trim();
    const value = part.slice(index + 1).trim();
    if (key === 't' && /^\d+$/.test(value)) timestamp = Number(value);
    else if (key === 'v1' && value) signatures.push(value);
  }
  if (timestamp === null || signatures.length === 0) return false;
  if (Math.abs(now - timestamp) > toleranceSeconds) return false;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest();
  return signatures.some((signature) => {
    const given = Buffer.from(signature, 'hex');
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

module.exports = { verifySignature };

// With Express, read the body raw on this route so the bytes are unchanged:
//
//   app.post('/woodsystems', express.raw({ type: 'application/json' }), (req, res) => {
//     const ok = verifySignature(process.env.WOODSYSTEMS_WEBHOOK_SECRET,
//                                req.get('WoodSystems-Signature'), req.body);
//     if (!ok) return res.sendStatus(400);
//     res.sendStatus(200);
//   });

<?php

// True when the WoodSystems-Signature header matches the raw request body.
//   $secret:  the endpoint's signing secret (whsec_...), from Settings, Integrations.
//   $header:  the WoodSystems-Signature header, t=<unix>,v1=<hex>[,v1=<hex>].
//   $rawBody: the request body exactly as received, before json_decode.
function woodsystems_verify_signature(string $secret, string $header, string $rawBody, int $tolerance = 300, ?int $now = null): bool
{
    $timestamp = null;
    $signatures = [];
    foreach (explode(',', $header) as $part) {
        $pair = explode('=', trim($part), 2);
        if (count($pair) !== 2) {
            continue;
        }
        [$key, $value] = $pair;
        if ($key === 't' && ctype_digit($value)) {
            $timestamp = (int) $value;
        } elseif ($key === 'v1' && $value !== '') {
            $signatures[] = $value;
        }
    }
    if ($timestamp === null || count($signatures) === 0) {
        return false;
    }
    $now = $now ?? time();
    if (abs($now - $timestamp) > $tolerance) {
        return false;
    }
    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) {
            return true;
        }
    }
    return false;
}

// For example:
//
//   $rawBody = file_get_contents('php://input');
//   $header = $_SERVER['HTTP_WOODSYSTEMS_SIGNATURE'] ?? '';
//   if (!woodsystems_verify_signature(getenv('WOODSYSTEMS_WEBHOOK_SECRET'), $header, $rawBody)) {
//       http_response_code(400);
//       exit;
//   }

package webhooks

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"strconv"
	"strings"
	"time"
)

// VerifySignature reports whether the WoodSystems-Signature header matches the raw request body.
//
//	secret:  the endpoint's signing secret (whsec_...), from Settings, Integrations.
//	header:  the WoodSystems-Signature header, t=<unix>,v1=<hex>[,v1=<hex>].
//	rawBody: the request body exactly as received, before JSON decoding.
//
// Pass 5*time.Minute as tolerance and time.Now() as now.
func VerifySignature(secret, header string, rawBody []byte, tolerance time.Duration, now time.Time) bool {
	timestamp := int64(-1)
	var signatures []string
	for _, part := range strings.Split(header, ",") {
		key, value, ok := strings.Cut(strings.TrimSpace(part), "=")
		if !ok {
			continue
		}
		switch key {
		case "t":
			if t, err := strconv.ParseInt(value, 10, 64); err == nil && t >= 0 {
				timestamp = t
			}
		case "v1":
			if value != "" {
				signatures = append(signatures, value)
			}
		}
	}
	if timestamp < 0 || len(signatures) == 0 {
		return false
	}
	age := now.Sub(time.Unix(timestamp, 0))
	if age < 0 {
		age = -age
	}
	if age > tolerance {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(strconv.FormatInt(timestamp, 10) + "."))
	mac.Write(rawBody)
	expected := mac.Sum(nil)
	for _, signature := range signatures {
		given, err := hex.DecodeString(signature)
		if err == nil && hmac.Equal(given, expected) {
			return true
		}
	}
	return false
}