Webhooks

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

const app = express();

// The signature covers the RAW body. Parse it after verifying, never before.
app.post('/webhooks/unifiwallet',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const header = req.get('X-UW-Signature') || '';
    const timestamp = req.get('X-UW-Timestamp') || '';
    const raw = req.body.toString('utf8');

    // Reject anything old enough to be a replay.
    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
      return res.status(400).send('stale');
    }

    const expected = createHmac('sha256', process.env.UW_WEBHOOK_SECRET)
      .update(`${timestamp}.${raw}`)
      .digest('hex');

    // A rotation sends two v1 values. Accept either.
    const presented = header.split(',')
      .filter((p) => p.startsWith('v1='))
      .map((p) => p.slice(3));

    const ok = presented.some((sig) => {
      const a = Buffer.from(sig, 'hex');
      const b = Buffer.from(expected, 'hex');
      return a.length === b.length && timingSafeEqual(a, b);
    });

    if (!ok) return res.status(400).send('bad signature');

    const event = JSON.parse(raw);

    // Answer first, work afterwards. We retry on anything but a 2xx, and a
    // slow handler looks identical to a broken one.
    res.status(200).end();
    handle(event).catch(console.error);
  });

import hashlib, hmac, os, time
from flask import Flask, request

app = Flask(__name__)

@app.post("/webhooks/unifiwallet")
def webhook():
    # The signature covers the RAW body. Do not let a framework parse it first.
    raw = request.get_data(as_text=True)
    timestamp = request.headers.get("X-UW-Timestamp", "")
    header = request.headers.get("X-UW-Signature", "")

    if abs(time.time() - int(timestamp or 0)) > 300:
        return "stale", 400

    expected = hmac.new(
        os.environ["UW_WEBHOOK_SECRET"].encode(),
        f"{timestamp}.{raw}".encode(),
        hashlib.sha256,
    ).hexdigest()

    # A rotation sends two v1 values. Accept either.
    presented = [p[3:] for p in header.split(",") if p.startswith("v1=")]
    if not any(hmac.compare_digest(sig, expected) for sig in presented):
        return "bad signature", 400

    event = request.get_json(force=True)

    # Answer immediately; do the work out of band.
    enqueue(event)
    return "", 200

func Webhook(w http.ResponseWriter, r *http.Request) {
	raw, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
	if err != nil {
		w.WriteHeader(http.StatusBadRequest)
		return
	}

	timestamp := r.Header.Get("X-UW-Timestamp")
	seconds, _ := strconv.ParseInt(timestamp, 10, 64)
	if math.Abs(float64(time.Now().Unix()-seconds)) > 300 {
		w.WriteHeader(http.StatusBadRequest)
		return
	}

	mac := hmac.New(sha256.New, []byte(os.Getenv("UW_WEBHOOK_SECRET")))
	mac.Write([]byte(timestamp + "." + string(raw)))
	expected := mac.Sum(nil)

	// A rotation sends two v1 values. Accept either.
	ok := false
	for _, part := range strings.Split(r.Header.Get("X-UW-Signature"), ",") {
		if !strings.HasPrefix(part, "v1=") {
			continue
		}
		if presented, err := hex.DecodeString(part[3:]); err == nil {
			if hmac.Equal(presented, expected) {
				ok = true
			}
		}
	}
	if !ok {
		w.WriteHeader(http.StatusBadRequest)
		return
	}

	var event Event
	json.Unmarshal(raw, &event)

	w.WriteHeader(http.StatusOK) // answer first
	go handle(event)
}

<?php

$raw = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_UW_TIMESTAMP'] ?? '';
$header = $_SERVER['HTTP_X_UW_SIGNATURE'] ?? '';

if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(400);
    exit('stale');
}

$expected = hash_hmac('sha256', $timestamp . '.' . $raw, getenv('UW_WEBHOOK_SECRET'));

// A rotation sends two v1 values. Accept either.
$ok = false;
foreach (explode(',', $header) as $part) {
    if (str_starts_with($part, 'v1=') && hash_equals($expected, substr($part, 3))) {
        $ok = true;
    }
}

if (!$ok) {
    http_response_code(400);
    exit('bad signature');
}

$event = json_decode($raw, true);

http_response_code(200); // answer first
handle($event);