Webhooks

import crypto from 'crypto';

function verifyWebhookSignature(payload, signature, timestamp, secret) {
  // Check timestamp is within 5 minutes
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    throw new Error('Timestamp too old');
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${JSON.stringify(payload)}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Compare signatures using timing-safe comparison
  const expected = Buffer.from(expectedSignature, 'hex');
  const received = Buffer.from(signature.replace('sha256=', ''), 'hex');

  if (!crypto.timingSafeEqual(expected, received)) {
    throw new Error('Invalid signature');
  }

  return true;
}

// In your webhook handler
app.post('/webhooks/reachscore', (req, res) => {
  try {
    verifyWebhookSignature(
      req.body,
      req.headers['x-reachscore-signature'],
      req.headers['x-reachscore-timestamp'],
      process.env.WEBHOOK_SECRET
    );

    // Process the event
    const event = req.body;
    switch (event.type) {
      case 'test.completed':
        handleTestCompleted(event.data);
        break;
      // ... handle other events
    }

    res.status(200).send('OK');
  } catch (error) {
    res.status(400).send('Invalid signature');
  }
});

import hmac
import hashlib
import time
import json

def verify_webhook_signature(payload, signature, timestamp, secret):
    # Check timestamp is within 5 minutes
    now = int(time.time())
    if abs(now - int(timestamp)) > 300:
        raise ValueError("Timestamp too old")

    # Compute expected signature
    signed_payload = f"{timestamp}.{json.dumps(payload)}"
    expected_signature = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    # Compare signatures
    received = signature.replace("sha256=", "")
    if not hmac.compare_digest(expected_signature, received):
        raise ValueError("Invalid signature")

    return True