Webhooks

import crypto from 'node:crypto'
import express from 'express'
 
const app = express()
 
// express.raw keeps the exact bytes BloomText signed.
app.post('/webhooks/bloomtext', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-BloomText-Signature')
  if (!verify(req.body, header, process.env.BLOOMTEXT_WEBHOOK_SECRET)) {
    return res.sendStatus(400)
  }
 
  const event = JSON.parse(req.body)
  // Deduplicate by event.id, store the event, then process it in the background.
  res.sendStatus(200)
})
 
function verify(rawBody, header, secret) {
  if (!header) return false
  const parts = Object.fromEntries(header.split(',').map((part) => part.split('=')))
  if (!parts.t || !parts.v1 || Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false
 
  const expected = crypto.createHmac('sha256', secret).update(`${parts.t}.`).update(rawBody).digest('hex')
  return expected.length === parts.v1.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1))
}
 
app.listen(3000)

import hashlib
import hmac
import os
import time
 
from flask import Flask, abort, request
 
app = Flask(__name__)
SECRET = os.environ["BLOOMTEXT_WEBHOOK_SECRET"].encode()
 
 
def verify(raw_body: bytes, header: str | None) -> bool:
    if not header:
        return False
    parts = dict(part.split("=", 1) for part in header.split(","))
    timestamp, signature = parts.get("t"), parts.get("v1")
    if not timestamp or not signature or abs(time.time() - int(timestamp)) > 300:
        return False
    expected = hmac.new(SECRET, f"{timestamp}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)
 
 
@app.post("/webhooks/bloomtext")
def bloomtext_webhook():
    if not verify(request.get_data(), request.headers.get("X-BloomText-Signature")):
        abort(400)
    event = request.get_json()
    # Deduplicate by event["id"], store the event, then process it in the background.
    return "", 200

package main
 
import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)
 
func verify(body []byte, header, secret string) bool {
	var timestamp, signature string
	for _, part := range strings.Split(header, ",") {
		key, value, _ := strings.Cut(part, "=")
		switch key {
		case "t":
			timestamp = value
		case "v1":
			signature = value
		}
	}
	ts, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil || signature == "" {
		return false
	}
	if age := time.Now().Unix() - ts; age > 300 || age < -300 {
		return false
	}
 
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(timestamp + "."))
	mac.Write(body)
	expected := hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(expected), []byte(signature))
}
 
func webhook(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(r.Body)
	if err != nil || !verify(body, r.Header.Get("X-BloomText-Signature"), os.Getenv("BLOOMTEXT_WEBHOOK_SECRET")) {
		http.Error(w, "invalid signature", http.StatusBadRequest)
		return
	}
 
	var event map[string]any
	_ = json.Unmarshal(body, &event)
	// Deduplicate by event["id"], store the event, then process it in the background.
	w.WriteHeader(http.StatusOK)
}
 
func main() {
	http.HandleFunc("/webhooks/bloomtext", webhook)
	http.ListenAndServe(":3000", nil)
}

require "sinatra"
require "openssl"
require "json"
 
def verify(raw_body, header, secret)
  return false unless header
 
  parts = header.split(",").to_h { |part| part.split("=", 2) }
  timestamp, signature = parts["t"], parts["v1"]
  return false unless timestamp && signature && (Time.now.to_i - timestamp.to_i).abs <= 300
 
  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}.#{raw_body}")
  Rack::Utils.secure_compare(expected, signature)
end
 
post "/webhooks/bloomtext" do
  raw_body = request.body.read
  halt 400 unless verify(raw_body, request.env["HTTP_X_BLOOMTEXT_SIGNATURE"], ENV.fetch("BLOOMTEXT_WEBHOOK_SECRET"))
 
  event = JSON.parse(raw_body)
  # Deduplicate by event["id"], store the event, then process it in the background.
  status 200
end