Webhooks

import crypto from "node:crypto";
import express from "express";

const app = express();

// The body as bytes: the signature is over exactly what was sent.
app.post("/webhooks/shoply", express.raw({ type: "application/json" }), (request, response) => {
  const timestamp = request.get("X-Shoply-Timestamp") ?? "";
  const signature = request.get("X-Shoply-Signature") ?? "";

  const expected =
    "v1=" +
    crypto
      .createHmac("sha256", process.env.SHOPLY_WEBHOOK_SECRET)
      .update(`${timestamp}.`)
      .update(request.body)
      .digest("hex");

  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) <= 300;
  const genuine =
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

  if (!fresh || !genuine) {
    return response.status(401).send("Bad signature");
  }

  const event = JSON.parse(request.body);

  // Answer first, then do the work.
  response.status(200).send("ok");

  handle(event, request.get("X-Shoply-Delivery"));
});

import hashlib, hmac, os, time
from flask import Flask, abort, request

app = Flask(__name__)

@app.post("/webhooks/shoply")
def shoply():
    timestamp = request.headers.get("X-Shoply-Timestamp", "")
    signature = request.headers.get("X-Shoply-Signature", "")
    body = request.get_data()  # the bytes as they arrived

    expected = "v1=" + hmac.new(
        os.environ["SHOPLY_WEBHOOK_SECRET"].encode(),
        timestamp.encode() + b"." + body,
        hashlib.sha256,
    ).hexdigest()

    fresh = timestamp.isdigit() and abs(time.time() - int(timestamp)) <= 300

    if not fresh or not hmac.compare_digest(signature, expected):
        abort(401)

    handle(request.get_json(), request.headers.get("X-Shoply-Delivery"))

    return "ok"

<?php

$body      = file_get_contents('php://input'); // the bytes as they arrived
$timestamp = $_SERVER['HTTP_X_SHOPLY_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_SHOPLY_SIGNATURE'] ?? '';

$expected = 'v1=' . hash_hmac('sha256', $timestamp . '.' . $body, getenv('SHOPLY_WEBHOOK_SECRET'));

$fresh = ctype_digit($timestamp) && abs(time() - (int) $timestamp) <= 300;

if (!$fresh || !hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Bad signature');
}

$event = json_decode($body, true);

handle($event, $_SERVER['HTTP_X_SHOPLY_DELIVERY'] ?? '');

echo 'ok';

func shoply(w http.ResponseWriter, r *http.Request) {
	body, _ := io.ReadAll(r.Body) // the bytes as they arrived

	timestamp := r.Header.Get("X-Shoply-Timestamp")
	signature := r.Header.Get("X-Shoply-Signature")

	mac := hmac.New(sha256.New, []byte(os.Getenv("SHOPLY_WEBHOOK_SECRET")))
	mac.Write([]byte(timestamp + "."))
	mac.Write(body)

	expected := "v1=" + hex.EncodeToString(mac.Sum(nil))

	sent, err := strconv.ParseInt(timestamp, 10, 64)
	fresh := err == nil && math.Abs(float64(time.Now().Unix()-sent)) <= 300

	if !fresh || !hmac.Equal([]byte(signature), []byte(expected)) {
		http.Error(w, "Bad signature", http.StatusUnauthorized)
		return
	}

	w.Write([]byte("ok"))
}