Webhooks

import express from 'express'
import { createHmac, timingSafeEqual } from 'node:crypto'

const app = express()
app.post('/hansapay/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const merchantId = req.get('X-MerchantID')
  const message = `${merchantId}\n${req.get('X-Timestamp')}\n${req.get('X-Nonce')}\n`
  const expected = createHmac('sha256', process.env.HANSAPAY_SECRET_KEY)
    .update(Buffer.concat([Buffer.from(message), req.body]))
    .digest()
  const received = Buffer.from(req.get('X-Sign') || '', 'hex')
  if (merchantId !== process.env.HANSAPAY_MERCHANT_ID ||
      received.length !== expected.length || !timingSafeEqual(received, expected)) {
    return res.status(401).send('invalid signature')
  }
  const event = JSON.parse(req.body.toString('utf8'))
  // Record the event idempotently, then acknowledge.
  res.type('text/plain').send('success')
})

import hashlib, hmac, os
from flask import Flask, request

app = Flask(__name__)

@app.post("/hansapay/webhook")
def hansapay_webhook():
    raw = request.get_data()
    merchant_id = request.headers.get("X-MerchantID", "")
    message = f"{merchant_id}\n{request.headers.get('X-Timestamp', '')}\n{request.headers.get('X-Nonce', '')}\n".encode("utf-8") + raw
    expected = hmac.new(os.environ["HANSAPAY_SECRET_KEY"].encode("utf-8"), message, hashlib.sha256).hexdigest()
    if merchant_id != os.environ["HANSAPAY_MERCHANT_ID"] or not hmac.compare_digest(expected, request.headers.get("X-Sign", "").lower()):
        return "invalid signature", 401
    event = request.get_json()
    # Record the event idempotently, then acknowledge.
    return "success", 200, {"Content-Type": "text/plain"}

<?php
$raw = file_get_contents('php://input');
$merchantId = $_SERVER['HTTP_X_MERCHANTID'] ?? '';
$message = $merchantId . "\n" . ($_SERVER['HTTP_X_TIMESTAMP'] ?? '') . "\n" . ($_SERVER['HTTP_X_NONCE'] ?? '') . "\n" . $raw;
$expected = hash_hmac('sha256', $message, getenv('HANSAPAY_SECRET_KEY'));
if ($merchantId !== getenv('HANSAPAY_MERCHANT_ID') || !hash_equals($expected, strtolower($_SERVER['HTTP_X_SIGN'] ?? ''))) {
    http_response_code(401);
    exit('invalid signature');
}
$event = json_decode($raw, true);
// Record the event idempotently, then acknowledge.
header('Content-Type: text/plain');
echo 'success';