Webhooks

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.PAYWIRE_WEBHOOK_SECRET; // whsec_...

app.post("/webhooks/paywire", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("Web3Getaway-Signature") ?? "";
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = Number(parts.t);
  const expected = crypto.createHmac("sha256", SECRET).update(`${parts.t}.${req.body}`).digest("hex");

  const valid =
    parts.v1?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected)) &&
    Math.abs(Date.now() / 1000 - t) <= 300;
  if (!valid) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  res.sendStatus(200); // acknowledge first, then work
  handle(event);
});

import hashlib, hmac, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["PAYWIRE_WEBHOOK_SECRET"].encode()  # whsec_...

@app.post("/webhooks/paywire")
def paywire_webhook():
    header = request.headers.get("Web3Getaway-Signature", "")
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    body = request.get_data()  # raw bytes
    expected = hmac.new(SECRET, f"{parts.get('t')}.".encode() + body, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(expected, parts.get("v1", "")):
        abort(400)
    if abs(time.time() - int(parts["t"])) > 300:
        abort(400)

    event = request.get_json()
    handle(event)
    return "", 200

using System.Security.Cryptography;
using System.Text;

app.MapPost("/webhooks/paywire", async (HttpRequest request, IConfiguration config) =>
{
    var secret = config["Paywire:WebhookSecret"]!; // whsec_...
    using var reader = new StreamReader(request.Body);
    var body = await reader.ReadToEndAsync();

    var parts = request.Headers["Web3Getaway-Signature"].ToString()
        .Split(',').Select(p => p.Split('=', 2)).Where(p => p.Length == 2).ToDictionary(p => p[0], p => p[1]);
    if (!parts.TryGetValue("t", out var t) || !parts.TryGetValue("v1", out var v1) || !long.TryParse(t, out var seconds))
        return Results.BadRequest();

    var mac = HMACSHA256.HashData(Encoding.UTF8.GetBytes(secret), Encoding.UTF8.GetBytes($"{t}.{body}"));
    var expected = Convert.ToHexStringLower(mac);
    var fresh = Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - seconds) <= 300;
    if (!fresh || !CryptographicOperations.FixedTimeEquals(Encoding.ASCII.GetBytes(expected), Encoding.ASCII.GetBytes(v1)))
        return Results.BadRequest();

    // handle the event...
    return Results.Ok();
});