Webhooks

<?php
function houseraWebhookIsValid(string $body, string $id, string $timestamp, string $signatures, string $secret): bool
{
    // 1. A delivery older or newer than 5 minutes is refused (replay protection).
    if (! ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
        return false;
    }

    // 2. The HMAC key is the base64-decoded part after "whsec_".
    $key = base64_decode(substr($secret, strlen('whsec_')), true);
    if ($key === false) {
        return false;
    }
    $expected = base64_encode(hash_hmac('sha256', "{$id}.{$timestamp}.{$body}", $key, true));

    // 3. Constant-time comparison with every "v1,<signature>" in the header.
    foreach (explode(' ', $signatures) as $candidate) {
        [$version, $signature] = array_pad(explode(',', $candidate, 2), 2, '');
        if ($version === 'v1' && hash_equals($expected, $signature)) {
            return true;
        }
    }

    return false;
}

$body = file_get_contents('php://input');
$valid = houseraWebhookIsValid(
    $body,
    $_SERVER['HTTP_WEBHOOK_ID'] ?? '',
    $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? '',
    $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '',
    getenv('HOUSERA_WEBHOOK_SECRET'),
);

if (! $valid) {
    http_response_code(401);
    exit;
}

$event = json_decode($body, true);
// Queue $event for processing, then answer fast.
http_response_code(204);

import crypto from 'node:crypto';
import express from 'express';

const SECRET = process.env.HOUSERA_WEBHOOK_SECRET; // "whsec_..."
const KEY = Buffer.from(SECRET.slice('whsec_'.length), 'base64');

function isValid(rawBody, id, timestamp, signatures) {
  // 1. A delivery older or newer than 5 minutes is refused (replay protection).
  const ts = Number(timestamp);
  if (!Number.isInteger(ts) || Math.abs(Date.now() / 1000 - ts) > 300) return false;

  // 2. HMAC-SHA256 over "id.timestamp.body", base64.
  const expected = crypto
    .createHmac('sha256', KEY)
    .update(`${id}.${timestamp}.`)
    .update(rawBody)
    .digest();

  // 3. Constant-time comparison with every "v1,<signature>" in the header.
  return (signatures || '').split(' ').some((candidate) => {
    const [version, signature] = candidate.split(',', 2);
    if (version !== 'v1' || !signature) return false;
    const given = Buffer.from(signature, 'base64');
    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
}

const app = express();

// The raw body: the signature is computed over the exact bytes received.
app.post('/hooks/housera', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = isValid(
    req.body,
    req.get('webhook-id'),
    req.get('webhook-timestamp'),
    req.get('webhook-signature'),
  );
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString('utf8'));
  // Queue the event for processing, then answer fast.
  res.sendStatus(204);
});

app.listen(3000);

import base64, hashlib, hmac, json, os, time
from flask import Flask, request

SECRET = os.environ["HOUSERA_WEBHOOK_SECRET"]  # "whsec_..."
KEY = base64.b64decode(SECRET[len("whsec_"):])

def is_valid(body: bytes, msg_id: str, timestamp: str, signatures: str) -> bool:
    # 1. A delivery older or newer than 5 minutes is refused (replay protection).
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > 300:
        return False

    # 2. HMAC-SHA256 over "id.timestamp.body", base64.
    signed = f"{msg_id}.{timestamp}.".encode() + body
    expected = base64.b64encode(hmac.new(KEY, signed, hashlib.sha256).digest()).decode()

    # 3. Constant-time comparison with every "v1,<signature>" in the header.
    for candidate in signatures.split(" "):
        version, _, signature = candidate.partition(",")
        if version == "v1" and hmac.compare_digest(expected, signature):
            return True
    return False

app = Flask(__name__)

@app.post("/hooks/housera")
def housera_webhook():
    body = request.get_data()  # the raw bytes, before any JSON parsing
    if not is_valid(
        body,
        request.headers.get("webhook-id", ""),
        request.headers.get("webhook-timestamp", ""),
        request.headers.get("webhook-signature", ""),
    ):
        return "", 401

    event = json.loads(body)
    # Queue the event for processing, then answer fast.
    return "", 204