Webhooks

import { createHmac, timingSafeEqual } from 'node:crypto';
import { createServer } from 'node:http';

const secret = process.env.N1CO_WEBHOOK_SECRET; // whsec_…

function verify(headers, body) {
  const id = headers['webhook-id'];
  const timestamp = headers['webhook-timestamp'];
  const signatures = headers['webhook-signature'];
  if (!id || !timestamp || !signatures || !/^\d+$/.test(timestamp)) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 5 * 60) return false;

  const key = Buffer.from(secret.slice('whsec_'.length), 'base64');
  const expected = createHmac('sha256', key).update(`${id}.${timestamp}.`).update(body).digest();
  return signatures.split(' ').some((entry) => {
    const [version, signature] = entry.split(',');
    if (version !== 'v1' || !signature) return false;
    const given = Buffer.from(signature, 'base64');
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}

createServer(async (req, res) => {
  if (req.method !== 'POST' || req.url !== '/n1co') return res.writeHead(404).end();
  const chunks = [];
  for await (const chunk of req) chunks.push(chunk);
  const body = Buffer.concat(chunks);
  if (!verify(req.headers, body)) return res.writeHead(400).end();

  const event = JSON.parse(body);
  // Store event.id to discard duplicates and process the event in the background.
  console.log(event.type, event.data.object.id);
  res.writeHead(204).end();
}).listen(3000);

using System.Security.Cryptography;
using System.Text;

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();
var secret = builder.Configuration["N1co:WebhookSecret"]!; // whsec_…

app.MapPost("/n1co", async (HttpRequest request) =>
{
    using var buffer = new MemoryStream();
    await request.Body.CopyToAsync(buffer);
    var body = buffer.ToArray();
    if (!Verify(request.Headers, body, secret)) return Results.BadRequest();

    // Store the webhook-id to discard duplicates and process the event in the background.
    return Results.NoContent();
});

app.Run();

static bool Verify(IHeaderDictionary headers, byte[] body, string secret)
{
    string id = headers["webhook-id"].ToString();
    string timestamp = headers["webhook-timestamp"].ToString();
    string signatures = headers["webhook-signature"].ToString();
    if (id.Length == 0 || !long.TryParse(timestamp, out var seconds)) return false;
    if (Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - seconds) > 5 * 60) return false;

    var key = Convert.FromBase64String(secret["whsec_".Length..]);
    var signed = Encoding.UTF8.GetBytes($"{id}.{timestamp}.").Concat(body).ToArray();
    var expected = HMACSHA256.HashData(key, signed);
    foreach (var entry in signatures.Split(' ', StringSplitOptions.RemoveEmptyEntries))
    {
        var parts = entry.Split(',', 2);
        if (parts.Length != 2 || parts[0] != "v1") continue;
        byte[] given;
        try { given = Convert.FromBase64String(parts[1]); }
        catch (FormatException) { continue; }
        if (CryptographicOperations.FixedTimeEquals(given, expected)) return true;
    }
    return false;
}