Webhooks

import crypto from 'node:crypto';
import express from 'express';

const app = express();

// The raw body — a parsed-and-re-serialized object will not match.
app.post(
	'/webhooks/taberna',
	express.raw({ type: 'application/json' }),
	(req, res) => {
		if (!verify(req.body, req.headers, process.env.TABERNA_WEBHOOK_SECRET)) {
			return res.sendStatus(400);
		}

		const { event, data } = JSON.parse(req.body.toString('utf8'));
		handle(event, data, req.get('x-taberna-delivery-id'));

		// Respond fast; do heavy work asynchronously.
		res.sendStatus(200);
	},
);

function verify(rawBody, headers, secret) {
	const timestamp = headers['x-taberna-timestamp'];
	const received = headers['x-taberna-signature'];
	if (!timestamp || !received) return false;

	// Replay defence: reject anything outside a 5-minute window.
	if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

	const expected = crypto
		.createHmac('sha256', secret)
		.update(`${timestamp}.${rawBody}`)
		.digest('hex');

	const a = Buffer.from(expected);
	const b = Buffer.from(received);
	return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hashlib
import hmac
import os
import time

from fastapi import FastAPI, Request, Response

app = FastAPI()
SECRET = os.environ["TABERNA_WEBHOOK_SECRET"].encode()


def verify(raw_body: bytes, headers) -> bool:
    timestamp = headers.get("x-taberna-timestamp")
    received = headers.get("x-taberna-signature")
    if not timestamp or not received:
        return False

    # Replay defence: reject anything outside a 5-minute window.
    if abs(time.time() - int(timestamp)) > 300:
        return False

    signed = f"{timestamp}.".encode() + raw_body
    expected = hmac.new(SECRET, signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, received)


@app.post("/webhooks/taberna")
async def taberna_webhook(request: Request):
    raw_body = await request.body()  # raw bytes, before any parsing
    if not verify(raw_body, request.headers):
        return Response(status_code=400)

    import json

    payload = json.loads(raw_body)
    handle(payload["event"], payload["data"], request.headers.get("x-taberna-delivery-id"))

    # Respond fast; do heavy work asynchronously.
    return Response(status_code=200)

<?php
// The raw body — never json_decode() before verifying.
$rawBody = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_TABERNA_TIMESTAMP'] ?? '';
$received = $_SERVER['HTTP_X_TABERNA_SIGNATURE'] ?? '';
$secret = getenv('TABERNA_WEBHOOK_SECRET');

if ($timestamp === '' || $received === '') {
    http_response_code(400);
    exit;
}

// Replay defence: reject anything outside a 5-minute window.
if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(400);
    exit;
}

$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

if (!hash_equals($expected, $received)) {
    http_response_code(400);
    exit;
}

$payload = json_decode($rawBody, true);
handle($payload['event'], $payload['data'], $_SERVER['HTTP_X_TABERNA_DELIVERY_ID'] ?? null);

// Respond fast; do heavy work asynchronously.
http_response_code(200);