Webhooks

Copyimport javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
public class WebhookController {

    private static final long TOLERANCE_SECONDS = 300;

    @Value("${csl.webhook.secret}")
    private String signingSecret;

    @PostMapping("/webhooks/csl")
    public ResponseEntity<Void> receive(
            @RequestBody byte[] rawBody,
            @RequestHeader("X-CSL-Signature") String signature) {

        byte[] signedPayload = rawBody;

        if (!verify(signedPayload, signature)) {
            return ResponseEntity.status(401).build();
        }

        // Acknowledge first, then process asynchronously. Deliveries time out
        // after 10 seconds and are retried, so slow handlers cause duplicates.
        events.submit(rawBody);
        return ResponseEntity.ok().build();
    }

    private boolean verify(byte[] signedPayload, String provided) {
        try {
            Mac mac = Mac.getInstance("HmacSHA512");
            mac.init(new SecretKeySpec(
                    signingSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
            String expected = java.util.Base64.getEncoder().encodeToString(mac.doFinal(signedPayload));

            // MessageDigest.isEqual is constant time. String.equals is not, and
            // returning early on the first mismatched byte leaks the signature.
            return MessageDigest.isEqual(
                    expected.getBytes(StandardCharsets.UTF_8),
                    provided.getBytes(StandardCharsets.UTF_8));
        } catch (Exception e) {
            return false;
        }
    }

}

Copyconst crypto = require("crypto");
const express = require("express");

const app = express();
const TOLERANCE_SECONDS = 300;

// express.raw, not express.json — the signature covers the bytes as sent.
app.post("/webhooks/csl", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.header("X-CSL-Signature");
  const signedPayload = req.body;

  const expected = crypto
    .createHmac("sha512", process.env.CSL_WEBHOOK_SECRET)
    .update(signedPayload)
    .digest("base64");

  // timingSafeEqual throws on a length mismatch, so check that first.
  const a = Buffer.from(expected);
  const b = Buffer.from(signature || "");
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.sendStatus(401);
  }

  // Acknowledge immediately, process on a queue.
  res.sendStatus(200);
  enqueue(JSON.parse(req.body.toString("utf8")));
});

Copyimport hashlib
import hmac
import os
import time

from flask import Flask, request, abort

app = Flask(__name__)
TOLERANCE_SECONDS = 300
SECRET = os.environ["CSL_WEBHOOK_SECRET"].encode()


@app.post("/webhooks/csl")
def receive():
    # request.get_data() returns the raw bytes; request.json would not.
    raw_body = request.get_data()
    signature = request.headers.get("X-CSL-Signature", "")
    signed_payload = raw_body

    digest = hmac.new(SECRET, signed_payload, hashlib.sha512)
    expected = base64.b64encode(digest.digest()).decode()

    # compare_digest is constant time; == is not.
    if not hmac.compare_digest(expected, signature):
        abort(401)

    enqueue(request.get_json())
    return "", 200

Copy<?php
$tolerance = 300;
$secret = getenv('CSL_WEBHOOK_SECRET');

// php://input is the raw body. $_POST would already be parsed.
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_CSL_SIGNATURE'] ?? '';
$signedPayload = $rawBody;

$expected = hash_hmac('sha512', $signedPayload, $secret, true);
$expected = base64_encode($expected);

// hash_equals is constant time; === is not.
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

http_response_code(200);
fastcgi_finish_request();   // acknowledge, then process
enqueue(json_decode($rawBody, true));