Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";
import { createServer } from "node:http";

const TOLERANCE_S = 300;

// True when header signs body with secret, within 5 minutes of now.
export function verifyFixedmark(secret, header, body, nowMs = Date.now()) {
  const fields = header.split(",").map((f) => f.trim().split("="));
  const t = Number(fields.find(([k]) => k === "t")?.[1]);
  const sigs = fields.filter(([k]) => k === "v1").map(([, v]) => v);
  if (!Number.isInteger(t) || sigs.length === 0) return false;
  if (Math.abs(nowMs / 1000 - t) > TOLERANCE_S) return false;
  const want = createHmac("sha256", secret).update(`${t}.`).update(body).digest();
  return sigs.some((s) => {
    const got = Buffer.from(s, "hex");
    return got.length === want.length && timingSafeEqual(got, want);
  });
}

createServer((req, res) => {
  const chunks = [];
  req.on("data", (c) => chunks.push(c));
  req.on("end", () => {
    const body = Buffer.concat(chunks); // the raw bytes, before any JSON parse
    const ok = verifyFixedmark(
      process.env.FIXEDMARK_WEBHOOK_SECRET,
      req.headers["x-fixedmark-signature"] ?? "",
      body,
    );
    console.log(ok ? "valid" : "invalid");
    res.writeHead(ok ? 200 : 400).end();
  });
}).listen(Number(process.env.PORT ?? 3000));

import hashlib
import hmac
import os
import time
from http.server import BaseHTTPRequestHandler, HTTPServer

TOLERANCE_S = 300


def verify_fixedmark(secret: str, header: str, body: bytes, now: float | None = None) -> bool:
    """True when header signs body with secret, within 5 minutes of now."""
    fields = [f.strip().split("=", 1) for f in header.split(",") if "=" in f]
    ts = [v for k, v in fields if k == "t"]
    sigs = [v for k, v in fields if k == "v1"]
    if len(ts) != 1 or not ts[0].isdigit() or not sigs:
        return False
    t = int(ts[0])
    if abs((now if now is not None else time.time()) - t) > TOLERANCE_S:
        return False
    want = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(want, s) for s in sigs)


class Hook(BaseHTTPRequestHandler):
    def do_POST(self):
        body = self.rfile.read(int(self.headers.get("Content-Length", "0")))
        ok = verify_fixedmark(
            os.environ["FIXEDMARK_WEBHOOK_SECRET"],
            self.headers.get("X-Fixedmark-Signature", ""),
            body,
        )
        print("valid" if ok else "invalid", flush=True)
        self.send_response(200 if ok else 400)
        self.end_headers()


HTTPServer(("", int(os.environ.get("PORT", "3000"))), Hook).serve_forever()

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"
	"log"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

const tolerance = 5 * time.Minute

// verifyFixedmark reports whether header signs body with secret, within
// 5 minutes of now.
func verifyFixedmark(secret, header string, body []byte, now time.Time) bool {
	var t int64
	var sigs []string
	for _, f := range strings.Split(header, ",") {
		k, v, _ := strings.Cut(strings.TrimSpace(f), "=")
		switch k {
		case "t":
			t, _ = strconv.ParseInt(v, 10, 64)
		case "v1":
			sigs = append(sigs, v)
		}
	}
	if t == 0 || len(sigs) == 0 {
		return false
	}
	if d := now.Sub(time.Unix(t, 0)); d > tolerance || d < -tolerance {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	fmt.Fprintf(mac, "%d.", t)
	mac.Write(body)
	want := mac.Sum(nil)
	for _, s := range sigs {
		if got, err := hex.DecodeString(s); err == nil && hmac.Equal(got, want) {
			return true
		}
	}
	return false
}

func main() {
	secret := os.Getenv("FIXEDMARK_WEBHOOK_SECRET")
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		body, err := io.ReadAll(r.Body)
		if err != nil {
			http.Error(w, "read body", http.StatusBadRequest)
			return
		}
		if !verifyFixedmark(secret, r.Header.Get("X-Fixedmark-Signature"), body, time.Now()) {
			fmt.Println("invalid")
			w.WriteHeader(http.StatusBadRequest)
			return
		}
		fmt.Println("valid")
	})
	port := os.Getenv("PORT")
	if port == "" {
		port = "3000"
	}
	log.Fatal(http.ListenAndServe(":"+port, nil))
}

// java Main.java
import com.sun.net.httpserver.HttpServer;
import java.net.InetSocketAddress;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.ArrayList;
import java.util.HexFormat;
import java.util.List;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
  static final long TOLERANCE_S = 300;

  // True when header signs body with secret, within 5 minutes of now.
  static boolean verifyFixedmark(String secret, String header, byte[] body, long nowS)
      throws Exception {
    long t = -1;
    List<byte[]> sigs = new ArrayList<>();
    for (String f : header.split(",")) {
      String[] kv = f.trim().split("=", 2);
      if (kv.length != 2) continue;
      try {
        if (kv[0].equals("t")) t = Long.parseLong(kv[1]);
        if (kv[0].equals("v1")) sigs.add(HexFormat.of().parseHex(kv[1]));
      } catch (IllegalArgumentException e) {
        return false;
      }
    }
    if (t < 0 || sigs.isEmpty() || Math.abs(nowS - t) > TOLERANCE_S) return false;
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    mac.update((t + ".").getBytes(StandardCharsets.UTF_8));
    byte[] want = mac.doFinal(body);
    for (byte[] s : sigs) if (MessageDigest.isEqual(s, want)) return true;
    return false;
  }

  public static void main(String[] args) throws Exception {
    String secret = System.getenv("FIXEDMARK_WEBHOOK_SECRET");
    int port = Integer.parseInt(System.getenv().getOrDefault("PORT", "3000"));
    HttpServer server = HttpServer.create(new InetSocketAddress(port), 0);
    server.createContext("/", ex -> {
      byte[] body = ex.getRequestBody().readAllBytes();
      String header = ex.getRequestHeaders().getFirst("X-Fixedmark-Signature");
      boolean ok;
      try {
        ok = header != null
            && verifyFixedmark(secret, header, body, System.currentTimeMillis() / 1000);
      } catch (Exception e) {
        ok = false;
      }
      System.out.println(ok ? "valid" : "invalid");
      ex.sendResponseHeaders(ok ? 200 : 400, -1);
      ex.close();
    });
    server.start();
  }
}