Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

/** rawBody must be the exact bytes received, before any JSON parsing. */
export function verifySignature(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.trim().split("=")));
  const t = Number(parts.t);
  const sig = parts.v1;
  if (!t || !sig) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;

  const expected = createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest("hex");
  const a = Buffer.from(sig);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

// Express: read the raw body so the signature can be checked.
app.post("/hooks/email", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifySignature(req.body, req.header("X-Sandbox-Signature") ?? "", process.env.WEBHOOK_SECRET)) {
    return res.sendStatus(400);
  }
  const event = JSON.parse(req.body);
  // handle event.data ...
  res.sendStatus(200);
});

import hashlib
import hmac
import time


def verify_signature(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    """raw_body must be the exact bytes received, before any JSON parsing."""
    try:
        parts = dict(p.strip().split("=", 1) for p in header.split(","))
        t, sig = int(parts["t"]), parts["v1"]
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(sig, expected)


# Flask
@app.post("/hooks/email")
def hook():
    if not verify_signature(request.get_data(), request.headers.get("X-Sandbox-Signature", ""), WEBHOOK_SECRET):
        return "", 400
    event = request.get_json()
    # handle event["data"] ...
    return "", 200

<?php
function verifySignature(string $rawBody, string $header, string $secret, int $tolerance = 300): bool
{
    $parts = [];
    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', trim($part), 2), 2, '');
        $parts[$key] = $value;
    }
    $t = (int) ($parts['t'] ?? 0);
    $sig = $parts['v1'] ?? '';
    if ($t === 0 || $sig === '' || abs(time() - $t) > $tolerance) {
        return false;
    }
    return hash_equals(hash_hmac('sha256', $t . '.' . $rawBody, $secret), $sig);
}

// $rawBody must be the exact bytes received, before any JSON parsing.
$rawBody = file_get_contents('php://input');
if (!verifySignature($rawBody, $_SERVER['HTTP_X_SANDBOX_SIGNATURE'] ?? '', getenv('WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit;
}
$event = json_decode($rawBody, true);
// handle $event['data'] ...
http_response_code(200);

package hooks

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"math"
	"strconv"
	"strings"
	"time"
)

// VerifySignature checks X-Sandbox-Signature against the exact bytes received.
func VerifySignature(rawBody []byte, header, secret string, tolerance time.Duration) bool {
	var t int64
	var sig string
	for _, part := range strings.Split(header, ",") {
		k, v, _ := strings.Cut(strings.TrimSpace(part), "=")
		switch k {
		case "t":
			t, _ = strconv.ParseInt(v, 10, 64)
		case "v1":
			sig = v
		}
	}
	if t == 0 || sig == "" || math.Abs(float64(time.Now().Unix()-t)) > tolerance.Seconds() {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(strconv.FormatInt(t, 10) + "."))
	mac.Write(rawBody)
	return hmac.Equal([]byte(sig), []byte(hex.EncodeToString(mac.Sum(nil))))
}