Signature verification

import hmac, hashlib, time
from fastapi import Request, HTTPException

SIGNING_SECRET = os.environ["YOTEL_WEBHOOK_SECRET"]

async def handle_webhook(request: Request):
    raw = await request.body()
    sig = request.headers.get("X-Yotel-Signature", "")
    ts = int(request.headers.get("X-Yotel-Timestamp", "0"))

    if abs(int(time.time()) - ts) > 300:
        raise HTTPException(401, "Replay window exceeded")

    signed = f"{ts}.".encode() + raw
    expected = "sha256=" + hmac.new(
        SIGNING_SECRET.encode(), signed, hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(expected, sig):
        raise HTTPException(401, "Bad signature")

    # Safe to parse + process
    import json
    event = json.loads(raw)
    return {"ok": True}

import yotel

SIGNING_SECRET = os.environ["YOTEL_WEBHOOK_SECRET"]

async def handle_webhook(request):
    raw = await request.body()
    try:
        event = yotel.webhook.verify_and_parse(
            raw,
            headers=request.headers,
            signing_secret=SIGNING_SECRET,
        )
    except yotel.webhook.InvalidSignature:
        raise HTTPException(401)
    # event is a typed Event
    ...

import crypto from "node:crypto";
import express from "express";

const SIGNING_SECRET = process.env.YOTEL_WEBHOOK_SECRET!;

app.post(
  "/webhooks/yotel",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = (req.headers["x-yotel-signature"] as string) ?? "";
    const ts = parseInt(
      (req.headers["x-yotel-timestamp"] as string) ?? "0",
      10,
    );

    if (Math.abs(Date.now() / 1000 - ts) > 300) {
      return res.status(401).send("Replay");
    }

    const signed = Buffer.concat([Buffer.from(`${ts}.`), req.body]);
    const expected =
      "sha256=" +
      crypto.createHmac("sha256", SIGNING_SECRET).update(signed).digest("hex");

    const ok =
      expected.length === sig.length &&
      crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
    if (!ok) return res.status(401).send("Bad signature");

    const event = JSON.parse(req.body.toString());
    // ... handle event
    res.status(200).send();
  },
);

import { verifyWebhook, InvalidSignature } from "@yotel/client";

app.post("/webhooks/yotel", express.raw({ type: "application/json" }),
  (req, res) => {
    try {
      const event = verifyWebhook({
        rawBody: req.body,
        headers: req.headers,
        signingSecret: process.env.YOTEL_WEBHOOK_SECRET!,
      });
      // event is typed
    } catch (e) {
      if (e instanceof InvalidSignature) return res.status(401).send();
      throw e;
    }
    res.status(200).send();
  });

import (
  "crypto/hmac"
  "crypto/sha256"
  "encoding/hex"
  "fmt"
  "io"
  "net/http"
  "os"
  "strconv"
  "time"
)

func VerifyYotelWebhook(r *http.Request, secret string) ([]byte, error) {
  raw, err := io.ReadAll(r.Body)
  if err != nil {
    return nil, err
  }
  sig := r.Header.Get("X-Yotel-Signature")
  tsStr := r.Header.Get("X-Yotel-Timestamp")
  ts, err := strconv.ParseInt(tsStr, 10, 64)
  if err != nil {
    return nil, fmt.Errorf("bad timestamp")
  }
  if abs(time.Now().Unix()-ts) > 300 {
    return nil, fmt.Errorf("replay window")
  }

  mac := hmac.New(sha256.New, []byte(secret))
  mac.Write([]byte(fmt.Sprintf("%d.", ts)))
  mac.Write(raw)
  expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))

  if !hmac.Equal([]byte(expected), []byte(sig)) {
    return nil, fmt.Errorf("bad signature")
  }
  return raw, nil
}