Webhooks

import crypto from "node:crypto";
import express from "express";

const app = express();

function verify(secret, rawBody, headers, toleranceSeconds = 300) {
  const timestamp = headers["x-socialapi-timestamp"];
  const received = headers["x-socialapi-signature-v2"];
  if (!timestamp || !received) return false;

  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(age) || age > toleranceSeconds) return false;

  const expected =
    "sha256=" +
    crypto
      .createHmac("sha256", secret)
      .update(`${timestamp}.`)
      .update(rawBody)
      .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(received);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post("/webhooks/socapi", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(process.env.SOCAPI_WEBHOOK_SECRET, req.body, req.headers)) {
    return res.sendStatus(401);
  }
  const payload = JSON.parse(req.body.toString("utf8"));
  // Store payload, then process it after you respond.
  res.sendStatus(200);
});

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)


def verify(secret: str, raw_body: bytes, headers, tolerance_seconds: int = 300) -> bool:
    timestamp = headers.get("X-SocialAPI-Timestamp", "")
    received = headers.get("X-SocialAPI-Signature-V2", "")
    try:
        age = abs(time.time() - int(timestamp))
    except ValueError:
        return False
    if age > tolerance_seconds:
        return False

    expected = "sha256=" + hmac.new(
        secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, received)


@app.post("/webhooks/socapi")
def webhook():
    if not verify(os.environ["SOCAPI_WEBHOOK_SECRET"], request.get_data(), request.headers):
        abort(401)
    payload = request.get_json()
    # Store payload, then process it after you respond.
    return "", 200

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"math"
	"net/http"
	"os"
	"strconv"
	"time"
)

func verify(secret string, rawBody []byte, h http.Header) bool {
	timestamp := h.Get("X-SocialAPI-Timestamp")
	received := h.Get("X-SocialAPI-Signature-V2")
	sent, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil || math.Abs(float64(time.Now().Unix()-sent)) > 300 {
		return false
	}

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(timestamp + "."))
	mac.Write(rawBody)
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(expected), []byte(received))
}

func handler(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(r.Body)
	if err != nil || !verify(os.Getenv("SOCAPI_WEBHOOK_SECRET"), body, r.Header) {
		http.Error(w, "invalid signature", http.StatusUnauthorized)
		return
	}
	// Store body, then process it after you respond.
	w.WriteHeader(http.StatusOK)
}

func main() {
	http.HandleFunc("/webhooks/socapi", handler)
	http.ListenAndServe(":8080", nil)
}

<?php
function verify(string $secret, string $rawBody, array $headers, int $tolerance = 300): bool {
    $timestamp = $headers['X-SocialAPI-Timestamp'] ?? '';
    $received = $headers['X-SocialAPI-Signature-V2'] ?? '';
    if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > $tolerance) {
        return false;
    }
    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $received);
}

$rawBody = file_get_contents('php://input');
if (!verify(getenv('SOCAPI_WEBHOOK_SECRET'), $rawBody, getallheaders())) {
    http_response_code(401);
    exit;
}
$payload = json_decode($rawBody, true);
// Store $payload, then process it after you respond.
http_response_code(200);