Webhooks

import crypto from 'node:crypto';
import express from 'express';

const WH_SECRET = 'whsec_...';

function verifyWebhook(payload, header, secret, tolerance = 300) {
  const parts = Object.fromEntries(
    header.split(',').filter(p => p.includes('=')).map(p => p.split('=', 2))
  );
  const { t, v1: sig } = parts;
  if (!t || !sig) return false;
  if (Math.abs(Date.now() / 1000 - parseInt(t)) > tolerance) return false;
  const secretHash = crypto.createHash('sha256').update(secret).digest('hex');
  const expected = crypto.createHmac('sha256', secretHash)
    .update(`${t}.`).update(payload).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}

const app = express();
app.post('/webhooks/ctf', express.raw({ type: '*/*' }), (req, res) => {
  if (!verifyWebhook(req.body, req.header('x-ctf-signature') ?? '', WH_SECRET)) {
    return res.sendStatus(401);
  }
  const event = JSON.parse(req.body.toString());
  // …handle event.event, event.data
  res.sendStatus(204);
});

<?php
$WH_SECRET = 'whsec_...';

function verify_webhook(string $payload, string $header, string $secret, int $tolerance = 300): bool {
    $parts = [];
    foreach (explode(',', $header) as $p) {
        if (strpos($p, '=') !== false) {
            [$k, $v] = explode('=', $p, 2);
            $parts[trim($k)] = trim($v);
        }
    }
    $t = $parts['t'] ?? null;
    $sig = $parts['v1'] ?? null;
    if (!$t || !$sig) return false;
    if (abs(time() - (int)$t) > $tolerance) return false;
    $secretHash = hash('sha256', $secret);
    $expected = hash_hmac('sha256', $t . '.' . $payload, $secretHash);
    return hash_equals($expected, $sig);
}

$body = file_get_contents('php://input');
if (!verify_webhook($body, $_SERVER['HTTP_X_CTF_SIGNATURE'] ?? '', $WH_SECRET)) {
    http_response_code(401); exit;
}
$event = json_decode($body, true);
// …handle $event['event'], $event['data']
http_response_code(204);