Webhooks

import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.HexFormat;
import java.util.Locale;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class WayaWebhook {

  // How far from now a timestamp may be. 300 seconds is a recommendation, not a requirement.
  private static final long TOLERANCE_SECONDS = 300;

  /** The lower-case hex HMAC-SHA256 of "<timestamp>.<raw body>". */
  static String computeSignature(byte[] rawBody, String timestamp, String secret)
      throws GeneralSecurityException {
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    mac.update((timestamp + ".").getBytes(StandardCharsets.UTF_8));
    return HexFormat.of().formatHex(mac.doFinal(rawBody));
  }

  static boolean verifyWebhook(
      byte[] rawBody, String timestampHeader, String signatureHeader, String secret)
      throws GeneralSecurityException {
    // The timestamp must be whole Unix seconds. [0-9] rejects signs, spaces and other digits.
    if (timestampHeader == null
        || signatureHeader == null
        || !timestampHeader.matches("[0-9]{1,18}")) {
      return false;
    }
    long age = Math.abs(Instant.now().getEpochSecond() - Long.parseLong(timestampHeader));
    if (age > TOLERANCE_SECONDS) {
      return false;
    }

    // Lower-case both sides, because the hex digits may arrive in either case.
    byte[] expected =
        computeSignature(rawBody, timestampHeader, secret).getBytes(StandardCharsets.UTF_8);
    byte[] received = signatureHeader.toLowerCase(Locale.ROOT).getBytes(StandardCharsets.UTF_8);
    // Compare the lengths first, so isEqual only ever sees arrays of the same length.
    return expected.length == received.length && MessageDigest.isEqual(expected, received);
  }
}

// verify-webhook.mjs, for Node.js 18 or later
import { createHmac, timingSafeEqual } from 'node:crypto';

// How far from now a timestamp may be. 300 seconds is a recommendation, not a requirement.
const TOLERANCE_SECONDS = 300;

// The lower-case hex HMAC-SHA256 of "<timestamp>.<raw body>". rawBody is a Buffer.
export function computeSignature(rawBody, timestamp, secret) {
  return createHmac('sha256', secret).update(`${timestamp}.`).update(rawBody).digest('hex');
}

export function verifyWebhook(rawBody, timestampHeader, signatureHeader, secret) {
  // The timestamp must be whole Unix seconds. Check the text, so nothing is parsed leniently.
  if (!/^[0-9]+$/.test(timestampHeader ?? '') || typeof signatureHeader !== 'string') {
    return false;
  }
  if (Math.abs(Date.now() / 1000 - Number(timestampHeader)) > TOLERANCE_SECONDS) {
    return false;
  }

  // Lower-case both sides, because the hex digits may arrive in either case.
  const expected = Buffer.from(computeSignature(rawBody, timestampHeader, secret));
  const received = Buffer.from(signatureHeader.toLowerCase());
  // timingSafeEqual throws when the lengths differ, so compare them first.
  return expected.length === received.length && timingSafeEqual(expected, received);
}

import hashlib
import hmac
import re
import time

# How far from now a timestamp may be. 300 seconds is a recommendation, not a requirement.
TOLERANCE_SECONDS = 300


def compute_signature(raw_body: bytes, timestamp: str, secret: str) -> str:
    """The lower-case hex HMAC-SHA256 of "<timestamp>.<raw body>"."""
    message = timestamp.encode() + b"." + raw_body
    return hmac.new(secret.encode(), message, hashlib.sha256).hexdigest()


def verify_webhook(
    raw_body: bytes,
    timestamp_header: str | None,
    signature_header: str | None,
    secret: str,
) -> bool:
    if not timestamp_header or not signature_header:
        return False
    # The timestamp must be whole Unix seconds. [0-9] rejects signs, spaces and other digits,
    # and the cap of 18 digits keeps int() away from huge numbers, which can raise.
    if re.fullmatch(r"[0-9]{1,18}", timestamp_header) is None:
        return False
    if abs(time.time() - int(timestamp_header)) > TOLERANCE_SECONDS:
        return False

    # Lower-case both sides, because the hex digits may arrive in either case.
    expected = compute_signature(raw_body, timestamp_header, secret).encode()
    received = signature_header.lower().encode()
    # Compare bytes: compare_digest raises TypeError for a str with non-ASCII characters.
    return hmac.compare_digest(expected, received)

using System;
using System.Globalization;
using System.Security.Cryptography;
using System.Text;

public static class WayaWebhook
{
    // How far from now a timestamp may be. 300 seconds is a recommendation, not a requirement.
    const long ToleranceSeconds = 300;

    // The lower-case hex HMAC-SHA256 of "<timestamp>.<raw body>".
    public static string ComputeSignature(byte[] rawBody, string timestamp, string secret)
    {
        using var hmac = IncrementalHash.CreateHMAC(HashAlgorithmName.SHA256, Encoding.UTF8.GetBytes(secret));
        hmac.AppendData(Encoding.UTF8.GetBytes(timestamp + "."));
        hmac.AppendData(rawBody);
        return Convert.ToHexString(hmac.GetHashAndReset()).ToLowerInvariant();
    }

    public static bool VerifyWebhook(
        byte[] rawBody, string? timestampHeader, string? signatureHeader, string secret)
    {
        if (timestampHeader is null || signatureHeader is null) return false;

        // NumberStyles.None accepts digits only: no sign and no spaces.
        if (!long.TryParse(timestampHeader, NumberStyles.None, CultureInfo.InvariantCulture, out var timestamp))
            return false;
        if (Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - timestamp) > ToleranceSeconds)
            return false;

        // Lower-case both sides, because the hex digits may arrive in either case.
        var expected = Encoding.UTF8.GetBytes(ComputeSignature(rawBody, timestampHeader, secret));
        var received = Encoding.UTF8.GetBytes(signatureHeader.ToLowerInvariant());
        // FixedTimeEquals takes the same time whatever the contents. Compare the lengths first.
        return expected.Length == received.Length && CryptographicOperations.FixedTimeEquals(expected, received);
    }
}