Webhooks

<?php

$secret = getenv('DF_WEBHOOK_SECRET');
$header = $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '';
$rawBody = file_get_contents('php://input');

$parts = [];
foreach (explode(',', $header) as $part) {
    [$key, $value] = array_pad(explode('=', $part, 2), 2, null);
    if ($key !== null && $value !== null) {
        $parts[$key] = $value;
    }
}

$timestamp = $parts['t'] ?? null;
$signature = $parts['v1'] ?? null;

if (!$timestamp || !$signature) {
    http_response_code(400);
    exit;
}

$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(400);
    exit;
}

// Reject stale deliveries to prevent replay of a captured request.
if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(400);
    exit;
}

$event = json_decode($rawBody, true, flags: JSON_THROW_ON_ERROR);

http_response_code(204);

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post(
  '/webhooks/digital-florists',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const secret = process.env.DF_WEBHOOK_SECRET;
    const header = req.header('Webhook-Signature') ?? '';
    const rawBody = req.body.toString('utf8');

    const parts = Object.fromEntries(
      header.split(',').map((part) => part.split('=', 2)),
    );

    const timestamp = parts.t;
    const signature = parts.v1;

    if (!timestamp || !signature) {
      return res.sendStatus(400);
    }

    const expected = crypto
      .createHmac('sha256', secret)
      .update(`${timestamp}.${rawBody}`, 'utf8')
      .digest('hex');

    const expectedBuffer = Buffer.from(expected, 'hex');
    const signatureBuffer = Buffer.from(signature, 'hex');

    if (
      expectedBuffer.length !== signatureBuffer.length ||
      !crypto.timingSafeEqual(expectedBuffer, signatureBuffer)
    ) {
      return res.sendStatus(400);
    }

    // Reject stale deliveries to prevent replay of a captured request.
    const toleranceSeconds = 300;
    const ageSeconds = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));

    if (!Number.isFinite(ageSeconds) || ageSeconds > toleranceSeconds) {
      return res.sendStatus(400);
    }

    const event = JSON.parse(rawBody);

    return res.sendStatus(204);
  },
);