Webhooks

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post('/hooks/verifner', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('VerifNer-Signature') ?? '';
  const parts = Object.fromEntries(header.split(',').map((kv) => kv.trim().split('=')));
  const t = Number(parts.t);
  const body = req.body.toString('utf8');

  const expected = crypto
    .createHmac('sha256', process.env.VERIFNER_WEBHOOK_SECRET)
    .update(`${t}.${body}`)
    .digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - t) <= 300;
  const valid =
    fresh &&
    typeof parts.v1 === 'string' &&
    parts.v1.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));
  if (!valid) return res.sendStatus(400);

  const event = JSON.parse(body);
  // Traitez l'événement de façon idempotente : event.id peut arriver plusieurs fois.
  handle(event).catch(console.error);
  res.sendStatus(200);
});

import hashlib, hmac, json, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["VERIFNER_WEBHOOK_SECRET"].encode()

@app.post("/hooks/verifner")
def verifner_hook():
    header = request.headers.get("VerifNer-Signature", "")
    parts = dict(kv.strip().split("=", 1) for kv in header.split(",") if "=" in kv)
    body = request.get_data(as_text=True)
    try:
        t = int(parts.get("t", ""))
    except ValueError:
        abort(400)
    expected = hmac.new(SECRET, f"{t}.{body}".encode(), hashlib.sha256).hexdigest()
    if abs(time.time() - t) > 300 or not hmac.compare_digest(parts.get("v1", ""), expected):
        abort(400)

    event = json.loads(body)
    # Traitez l'événement de façon idempotente : event["id"] peut arriver plusieurs fois.
    handle(event)
    return "", 200

<?php
$body = file_get_contents('php://input');
$header = $_SERVER['HTTP_VERIFNER_SIGNATURE'] ?? '';
$parts = [];
foreach (explode(',', $header) as $kv) {
    [$k, $v] = array_pad(explode('=', trim($kv), 2), 2, '');
    $parts[$k] = $v;
}
$t = (int) ($parts['t'] ?? 0);
$expected = hash_hmac('sha256', $t . '.' . $body, getenv('VERIFNER_WEBHOOK_SECRET'));
if (abs(time() - $t) > 300 || !hash_equals($expected, $parts['v1'] ?? '')) {
    http_response_code(400);
    exit;
}
$event = json_decode($body, true);
// Traitez l'événement de façon idempotente : $event['id'] peut arriver plusieurs fois.
http_response_code(200);