Verify a webhook signature

{
  "id": "evt_a1b2c3d4e5...",
  "type": "order.created",
  "createdAt": "2026-05-19T11:23:45.000Z",
  "data": {
    "orderId": "ord_xyz",
    "order": {
      /* enriched resource */
    }
  }
}

import crypto from 'crypto';
import express from 'express';

const SECRET = process.env.BRAINERCE_WEBHOOK_SECRET!;
const MAX_AGE_MS = 5 * 60 * 1000; // 5 minutes

const app = express();

// YOUR durable inbox (a table with a unique key on the event id). Implement it
// before going live: this stub throws, so an unimplemented copy answers 500 and
// Brainerce retries, rather than acknowledging events it never kept.
async function storeEvent(eventId: string, rawBody: Buffer): Promise<void> {
  // e.g. INSERT INTO webhook_inbox (event_id, body) VALUES ($1, $2)
  //      ON CONFLICT (event_id) DO NOTHING
  throw new Error('storeEvent not implemented');
}

// IMPORTANT: capture the RAW body (not parsed JSON) for HMAC.
// `express.json()` mutates whitespace — the signature won't match.
app.post('/webhooks/brainerce', express.raw({ type: 'application/json' }), async (req, res) => {
  const signature = req.header('X-Brainerce-Signature');
  const timestamp = req.header('X-Brainerce-Timestamp');
  if (!signature || !timestamp) {
    return res.status(400).send('Missing signature headers');
  }

  // 1. Replay window — reject anything older than 5 min.
  const ageMs = Date.now() - parseInt(timestamp, 10);
  if (Number.isNaN(ageMs) || ageMs > MAX_AGE_MS || ageMs < -60_000) {
    return res.status(400).send('Timestamp out of window');
  }

  // 2. Recompute signature over `${timestamp}.${rawBody}`.
  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(`${timestamp}.${req.body.toString('utf8')}`)
    .digest('hex');

  // 3. Constant-time compare.
  const sigBuf = Buffer.from(signature, 'hex');
  const expectedBuf = Buffer.from(expected, 'hex');
  if (sigBuf.length !== expectedBuf.length || !crypto.timingSafeEqual(sigBuf, expectedBuf)) {
    return res.status(400).send('Invalid signature');
  }

  // 4. Store the event durably, keyed by envelope id (a duplicate insert is a
  //    no-op), then acknowledge. If the insert fails, answer 5xx so we retry.
  try {
    const event = JSON.parse(req.body.toString('utf8'));
    await storeEvent(event.id, req.body);
  } catch {
    return res.status(500).send('Not stored');
  }
  res.status(202).send('Accepted');

  // 5. A separate worker processes pending inbox rows and marks each one done
  //    only after the work succeeds. Never mark an event handled before the
  //    work: a failure after that point makes our retry look like a duplicate.
});

import hashlib
import hmac
import json
import os
import time
from fastapi import FastAPI, Request, HTTPException

SECRET = os.environ["BRAINERCE_WEBHOOK_SECRET"].encode()
MAX_AGE_MS = 5 * 60 * 1000

app = FastAPI()


def store_event(event_id: str, raw_body: bytes) -> None:
    """YOUR durable inbox: insert, no-op if event_id already exists, raise on failure.

    e.g. INSERT INTO webhook_inbox (event_id, body) VALUES (%s, %s)
         ON CONFLICT (event_id) DO NOTHING
    This stub raises, so an unimplemented copy answers 500 and Brainerce retries.
    """
    raise NotImplementedError("store_event not implemented")


@app.post("/webhooks/brainerce")
async def webhook(request: Request):
    raw_body = await request.body()  # bytes; NOT request.json()
    signature = request.headers.get("X-Brainerce-Signature")
    timestamp = request.headers.get("X-Brainerce-Timestamp")
    if not signature or not timestamp:
        raise HTTPException(400, "Missing signature headers")

    try:
        age_ms = int(time.time() * 1000) - int(timestamp)
    except ValueError:
        raise HTTPException(400, "Malformed timestamp")
    if age_ms > MAX_AGE_MS or age_ms < -60_000:
        raise HTTPException(400, "Timestamp out of window")

    signed_payload = f"{timestamp}.".encode() + raw_body
    expected = hmac.new(SECRET, signed_payload, hashlib.sha256).hexdigest()

    # Constant-time compare.
    if not hmac.compare_digest(expected, signature):
        raise HTTPException(400, "Invalid signature")

    # Store durably BEFORE acknowledging; a worker processes it later and marks
    # it done only after the work succeeds.
    try:
        store_event(json.loads(raw_body)["id"], raw_body)
    except Exception:
        raise HTTPException(500, "Not stored")
    return {"ok": True}

package webhooks

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "errors"
    "io"
    "net/http"
    "os"
    "strconv"
    "time"
)

const maxAgeMs = 5 * 60 * 1000

var secret = os.Getenv("BRAINERCE_WEBHOOK_SECRET")

// storeEvent is YOUR durable inbox: insert, no-op if eventID already exists,
// return an error on failure. e.g.
//   INSERT INTO webhook_inbox (event_id, body) VALUES ($1, $2)
//   ON CONFLICT (event_id) DO NOTHING
// This stub fails, so an unimplemented copy answers 500 and Brainerce retries.
func storeEvent(eventID string, body []byte) error {
    return errors.New("storeEvent not implemented")
}

func Handle(w http.ResponseWriter, r *http.Request) {
    if secret == "" {
        // Fail closed: an HMAC with an empty key would accept anyone's forged signature.
        http.Error(w, "server misconfigured", http.StatusInternalServerError)
        return
    }

    sig := r.Header.Get("X-Brainerce-Signature")
    ts := r.Header.Get("X-Brainerce-Timestamp")
    body, err := io.ReadAll(r.Body)
    if err != nil || sig == "" || ts == "" {
        http.Error(w, "bad request", http.StatusBadRequest)
        return
    }

    tsMs, err := strconv.ParseInt(ts, 10, 64)
    if err != nil {
        http.Error(w, "bad ts", http.StatusBadRequest)
        return
    }
    age := time.Now().UnixMilli() - tsMs
    if age > maxAgeMs || age < -60_000 {
        http.Error(w, "stale", http.StatusBadRequest)
        return
    }

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(ts + "." + string(body)))
    expected := hex.EncodeToString(mac.Sum(nil))
    if !hmac.Equal([]byte(sig), []byte(expected)) {
        http.Error(w, "bad sig", http.StatusBadRequest)
        return
    }

    // Store durably BEFORE acknowledging; a worker processes it later and
    // marks it done only after the work succeeds.
    var env struct {
        ID string `json:"id"`
    }
    if err := json.Unmarshal(body, &env); err != nil || env.ID == "" {
        http.Error(w, "bad body", http.StatusBadRequest)
        return
    }
    if err := storeEvent(env.ID, body); err != nil {
        http.Error(w, "not stored", http.StatusInternalServerError)
        return
    }
    w.WriteHeader(http.StatusAccepted)
}