Webhooks

const crypto = require('crypto');

function verifyWebhook(req, secret) {
  const signature = req.headers['x-deapi-signature'];
  const timestamp = req.headers['x-deapi-timestamp'];
  const body = req.body.toString(); // Raw request body as string

  // Check timestamp is within 5 minutes
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return false; // Reject old requests (replay attack prevention)
  }

  // Calculate expected signature
  const message = `${timestamp}.${body}`;
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(message)
    .digest('hex');

  // Timing-safe comparison
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

import hmac
import hashlib
import time

def verify_webhook(headers, body, secret):
    signature = headers.get('X-DeAPI-Signature', '')
    timestamp = headers.get('X-DeAPI-Timestamp', '')

    # Check timestamp is within 5 minutes
    now = int(time.time())
    if abs(now - int(timestamp)) > 300:
        return False  # Reject old requests

    # Calculate expected signature
    message = f"{timestamp}.{body}"
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()

    # Timing-safe comparison
    return hmac.compare_digest(signature, expected)

function verifyWebhook(array $headers, string $body, string $secret): bool
{
    $signature = $headers['X-DeAPI-Signature'] ?? '';
    $timestamp = $headers['X-DeAPI-Timestamp'] ?? '';

    // Check timestamp is within 5 minutes
    if (abs(time() - (int) $timestamp) > 300) {
        return false; // Reject old requests
    }

    // Calculate expected signature
    $message = $timestamp . '.' . $body;
    $expected = 'sha256=' . hash_hmac('sha256', $message, $secret);

    // Timing-safe comparison
    return hash_equals($expected, $signature);
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "math"
    "strconv"
    "time"
)

func verifyWebhook(signature, timestamp, body, secret string) bool {
    // Check timestamp is within 5 minutes
    ts, _ := strconv.ParseInt(timestamp, 10, 64)
    now := time.Now().Unix()
    if math.Abs(float64(now-ts)) > 300 {
        return false
    }

    // Calculate expected signature
    message := fmt.Sprintf("%s.%s", timestamp, body)
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(message))
    expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))

    // Timing-safe comparison
    return hmac.Equal([]byte(signature), []byte(expected))
}