Webhooks: Best practices

<?php
// Shared secret generated by Mollie Webhooks system
$sharedSecret = 'your_shared_secret';

// Retrieve the signature from the headers (X-Mollie-Signature)
$headers = getallheaders();
$providedSignature = isset($headers['X-Mollie-Signature']) ? $headers['X-Mollie-Signature'] : null;

if (!$providedSignature) {
    http_response_code(400); // Bad Request
    echo "Missing signature.";
    exit;
}

// Retrieve the raw POST data
$payload = file_get_contents('php://input');

if (!$payload) {
    http_response_code(400); // Bad Request
    echo "Missing payload.";
    exit;
}

// Calculate the HMAC hash of the payload
$calculatedSignature = hash_hmac('sha256', $payload, $sharedSecret);

// Compare the calculated signature with the provided signature
if (!hash_equals($calculatedSignature, $providedSignature)) {
    http_response_code(403); // Forbidden
    echo "Invalid signature.";
    exit;
}

// Process the webhook payload
$data = json_decode($payload, true);

// Example: Log the payload
file_put_contents('webhook.log', print_r($data, true), FILE_APPEND);

http_response_code(200); // OK
echo "Webhook received and verified.";
?>

from flask import Flask, request, abort
import hmac
import hashlib

app = Flask(__name__)

# Shared secret provided by Mollie Webhooks system
SHARED_SECRET = 'your_shared_secret'

def verify_signature(payload, provided_signature):
    """
    Verify the webhook's authenticity by comparing the provided signature
    with the calculated HMAC signature.
    """
    # Calculate the HMAC signature
    calculated_signature = hmac.new(
        SHARED_SECRET.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()

    # Compare signatures securely
    return hmac.compare_digest(calculated_signature, provided_signature)

@app.route('/webhook', methods=['POST'])
def webhook():
    # Retrieve the signature from the headers
    provided_signature = request.headers.get('X-Mollie-Signature')
    if not provided_signature:
        abort(400, 'Missing signature.')

    # Get the raw payload
    payload = request.data
    if not payload:
        abort(400, 'Missing payload.')

    # Verify the signature
    if not verify_signature(payload, provided_signature):
        abort(403, 'Invalid signature.')

    # Process the webhook payload
    data = request.json  # Parse the JSON payload if needed

    # Example: Log the payload
    with open('webhook.log', 'a') as f:
        f.write(str(data) + '\n')

    return 'Webhook received and verified.', 200

if __name__ == '__main__':
    app.run(port=5000, debug=True)

const express = require('express');
const bodyParser = require('body-parser');
const crypto = require('crypto');

const app = express();
const PORT = 5000;

// Shared secret provided by Mollie Webhooks system
const SHARED_SECRET = 'your_shared_secret';

// Middleware to parse raw body for signature verification
app.use(bodyParser.raw({ type: '*/*' }));

/**
 * Verify the webhook's signature.
 * @param {Buffer} payload - Raw request body
 * @param {string} providedSignature - Signature from the request headers
 * @returns {boolean} - Whether the signature is valid
 */
function verifySignature(payload, providedSignature) {
    const calculatedSignature = crypto
        .createHmac('sha256', SHARED_SECRET)
        .update(payload)
        .digest('hex');

    // Use constant-time comparison to prevent timing attacks
    return crypto.timingSafeEqual(
        Buffer.from(calculatedSignature, 'utf-8'),
        Buffer.from(providedSignature, 'utf-8')
    );
}

app.post('/webhook', (req, res) => {
    // Retrieve the signature from the headers
    const providedSignature = req.headers['X-Mollie-Signature'];
    if (!providedSignature) {
        return res.status(400).send('Missing signature.');
    }

    // Get the raw payload
    const payload = req.body;
    if (!payload) {
        return res.status(400).send('Missing payload.');
    }

    // Verify the signature
    if (!verifySignature(payload, providedSignature)) {
        return res.status(403).send('Invalid signature.');
    }

    // Parse the payload as JSON (if applicable)
    let data;
    try {
        data = JSON.parse(payload.toString('utf-8'));
    } catch (err) {
        return res.status(400).send('Invalid JSON payload.');
    }

    // Example: Log the payload
    console.log('Verified webhook payload:', data);

    return res.status(200).send('Webhook received and verified.');
});

app.listen(PORT, () => {
    console.log(`Server running on http://localhost:${PORT}`);
});