Security

const crypto = require('crypto');

function verifyWebhookSignature({
  publicKeyPem,
  url,
  body,
  signatureB64,
  timestamp
}) {
  // 1. Check timestamp freshness (5-minute window)
  const currentTime = Math.floor(Date.now() / 1000);
  const requestTime = parseInt(timestamp);
  if (Math.abs(currentTime - requestTime) > 300) {
    console.error(`Timestamp ${requestTime} is outside acceptable range`);
    return false;
  }

  // 2. Recreate the signed content
  const bodyHash = crypto.createHash('sha256').update(body).digest('hex');
  const signatureContent = `${timestamp}.${url}.${bodyHash}`;
  
  // 3. Verify signature
  try {
    const verifier = crypto.createVerify('RSA-SHA256');
    verifier.update(signatureContent);
    return verifier.verify(publicKeyPem, signatureB64, 'base64');
  } catch (error) {
    console.error('Signature verification failed:', error.message);
    return false;
  }
}

// Express.js middleware example
function webhookSignatureMiddleware(req, res, next) {
  const signature = req.headers['x-webhook-signature'];
  const timestamp = req.headers['x-webhook-timestamp'];
  
  if (!signature || !timestamp) {
    return res.status(400).json({ error: 'Missing required headers' });
  }
  
  // Reconstruct full URL
  const protocol = req.protocol;
  const host = req.get('host');
  const originalUrl = req.originalUrl;
  const fullUrl = `${protocol}://${host}${originalUrl}`;
  
  // Get cached public key
  const publicKey = getCachedPublicKey();
  
  // Verify signature
  const isValid = verifyWebhookSignature({
    publicKeyPem: publicKey,
    url: fullUrl,
    body: req.rawBody, // Make sure to capture raw body
    signatureB64: signature,
    timestamp: timestamp
  });
  
  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  next();
}

// Usage with Express
const express = require('express');
const app = express();

// Important: Capture raw body before JSON parsing
app.use('/webhooks', express.raw({ type: 'application/json' }), (req, res, next) => {
  req.rawBody = req.body;
  req.body = JSON.parse(req.body.toString());
  next();
});

app.use('/webhooks', webhookSignatureMiddleware);

app.post('/webhooks', (req, res) => {
  // Your webhook logic here
  console.log('Verified webhook received:', req.body);
  res.status(200).send('OK');
});

package main

import (
    "crypto"
    "crypto/rsa"
    "crypto/sha256"
    "crypto/x509"
    "encoding/base64"
    "encoding/pem"
    "fmt"
    "io"
    "math"
    "net/http"
    "strconv"
    "time"
)

// VerifyWebhookSignature verifies the authenticity of a webhook request
func VerifyWebhookSignature(
    publicKeyPEM []byte,
    url string,
    body []byte,
    signatureB64 string,
    timestamp int64,
) error {
    // 1. Check timestamp freshness (5-minute window)
    now := time.Now().Unix()
    if math.Abs(float64(now-timestamp)) > 300 {
        return fmt.Errorf("timestamp %d is outside acceptable range", timestamp)
    }
    
    // 2. Reconstruct signed content
    bodyHash := sha256.Sum256(body)
    bodyHashHex := fmt.Sprintf("%x", bodyHash)
    signatureContent := fmt.Sprintf("%d.%s.%s", timestamp, url, bodyHashHex)
    
    // 3. Hash the content
    contentHash := sha256.Sum256([]byte(signatureContent))
    
    // 4. Parse public key
    block, _ := pem.Decode(publicKeyPEM)
    if block == nil {
        return fmt.Errorf("failed to parse PEM block")
    }
    
    publicKeyInterface, err := x509.ParsePKIXPublicKey(block.Bytes)
    if err != nil {
        return fmt.Errorf("failed to parse public key: %w", err)
    }
    
    publicKey, ok := publicKeyInterface.(*rsa.PublicKey)
    if !ok {
        return fmt.Errorf("not an RSA public key")
    }
    
    // 5. Decode signature
    signature, err := base64.StdEncoding.DecodeString(signatureB64)
    if err != nil {
        return fmt.Errorf("failed to decode signature: %w", err)
    }
    
    // 6. Verify signature
    err = rsa.VerifyPKCS1v15(publicKey, crypto.SHA256, contentHash[:], signature)
    if err != nil {
        return fmt.Errorf("signature verification failed: %w", err)
    }
    
    return nil
}

// HTTP handler example
func webhookHandler(w http.ResponseWriter, r *http.Request) {
    // Extract headers
    signature := r.Header.Get("X-Webhook-Signature")
    timestampStr := r.Header.Get("X-Webhook-Timestamp")
    
    if signature == "" || timestampStr == "" {
        http.Error(w, "Missing required headers", http.StatusBadRequest)
        return
    }
    
    // Parse timestamp
    timestamp, err := strconv.ParseInt(timestampStr, 10, 64)
    if err != nil {
        http.Error(w, "Invalid timestamp format", http.StatusBadRequest)
        return
    }
    
    // Read request body
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Failed to read request body", http.StatusBadRequest)
        return
    }
    
    // Reconstruct full URL
    scheme := "https"
    if r.TLS == nil {
        scheme = "http"
    }
    fullURL := fmt.Sprintf("%s://%s%s", scheme, r.Host, r.RequestURI)
    
    // Get cached public key (implement your caching)
    publicKey := getCachedPublicKey()
    
    // Verify signature
    err = VerifyWebhookSignature(publicKey, fullURL, body, signature, timestamp)
    if err != nil {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }
    
    // Process webhook
    fmt.Printf("Verified webhook received: %s\n", string(body))
    w.WriteHeader(http.StatusOK)
}

func main() {
    http.HandleFunc("/webhook", webhookHandler)
    fmt.Println("Webhook server starting on :8080")
    http.ListenAndServe(":8080", nil)
}