Webhook Configuration

const crypto = require('crypto');

function verifyWebhook(request, secret) {
  const signature = request.headers['confidence-webhook-signature'];
  const timestamp = request.headers['confidence-webhook-timestamp'];
  const payload = request.body; // Raw JSON string

  // Validate timestamp (within 5 minutes)
  const now = Math.floor(Date.now() / 1000);
  const requestTime = parseInt(timestamp);
  if (Math.abs(now - requestTime) > 300) {
    throw new Error('Timestamp too old or too far in the future');
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Compare signatures (constant-time)
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    throw new Error('Invalid signature');
  }

  return true;
}

import hmac
import hashlib
import time

def verify_webhook(headers, body, secret):
    signature = headers.get('confidence-webhook-signature')
    timestamp = headers.get('confidence-webhook-timestamp')

    # Validate timestamp (within 5 minutes)
    now = int(time.time())
    request_time = int(timestamp)
    if abs(now - request_time) > 300:
        raise ValueError('Timestamp too old or too far in the future')

    # Compute expected signature
    signed_payload = f"{timestamp}.{body}"
    expected_signature = hmac.new(
        secret.encode('utf-8'),
        signed_payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    # Compare signatures (constant-time)
    if not hmac.compare_digest(signature, expected_signature):
        raise ValueError('Invalid signature')

    return True

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;

public class WebhookVerifier {

  private static final String HMAC_SHA256 = "HmacSHA256";

  public static boolean verifyWebhook(String signature, String timestamp,
                                      String payload, String secret)
      throws Exception {
    // Validate timestamp (within 5 minutes)
    long now = Instant.now().getEpochSecond();
    long requestTime = Long.parseLong(timestamp);
    if (Math.abs(now - requestTime) > 300) {
      throw new IllegalArgumentException(
          "Timestamp too old or too far in the future");
    }

    // Compute expected signature
    String signedPayload = timestamp + "." + payload;
    SecretKeySpec secretKey = new SecretKeySpec(
        secret.getBytes(StandardCharsets.UTF_8), HMAC_SHA256);
    Mac mac = Mac.getInstance(HMAC_SHA256);
    mac.init(secretKey);
    byte[] hash = mac.doFinal(signedPayload.getBytes(StandardCharsets.UTF_8));
    String expectedSignature = bytesToHex(hash);

    // Compare signatures (constant-time)
    if (!MessageDigest.isEqual(
        signature.getBytes(StandardCharsets.UTF_8),
        expectedSignature.getBytes(StandardCharsets.UTF_8))) {
      throw new IllegalArgumentException("Invalid signature");
    }

    return true;
  }

  private static String bytesToHex(byte[] bytes) {
    StringBuilder result = new StringBuilder();
    for (byte b : bytes) {
      result.append(String.format("%02x", b));
    }
    return result.toString();
  }
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "crypto/subtle"
    "encoding/hex"
    "errors"
    "fmt"
    "math"
    "strconv"
    "time"
)

func verifyWebhook(signature, timestamp, payload, secret string) error {
    // Validate timestamp (within 5 minutes)
    now := time.Now().Unix()
    requestTime, err := strconv.ParseInt(timestamp, 10, 64)
    if err != nil {
        return fmt.Errorf("invalid timestamp: %w", err)
    }

    if math.Abs(float64(now-requestTime)) > 300 {
        return errors.New("timestamp too old or too far in the future")
    }

    // Compute expected signature
    signedPayload := timestamp + "." + payload
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(signedPayload))
    expectedSignature := hex.EncodeToString(mac.Sum(nil))

    // Compare signatures (constant-time)
    if subtle.ConstantTimeCompare(
        []byte(signature),
        []byte(expectedSignature)) != 1 {
        return errors.New("invalid signature")
    }
    return nil
}

use hmac::{Hmac, Mac};
use sha2::Sha256;
use std::time::{SystemTime, UNIX_EPOCH};

type HmacSha256 = Hmac<Sha256>;

fn verify_webhook(
    signature: &str,
    timestamp: &str,
    payload: &str,
    secret: &str,
) -> Result<bool, Box<dyn std::error::Error>> {
    // Validate timestamp (within 5 minutes)
    let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_secs();
    let request_time: u64 = timestamp.parse()?;

    if (now as i64 - request_time as i64).abs() > 300 {
        return Err("Timestamp too old or too far in the future".into());
    }

    // Compute expected signature
    let signed_payload = format!("{}.{}", timestamp, payload);
    let mut mac = HmacSha256::new_from_slice(secret.as_bytes())?;
    mac.update(signed_payload.as_bytes());
    let result = mac.finalize();
    let expected_signature = hex::encode(result.into_bytes());

    // Compare signatures (constant-time)
    if expected_signature != signature {
        return Err("Invalid signature".into());
    }

    Ok(true)
}