Webhooks

app.post('/webhook-handler', (req, res) => {
  // Process the result asynchronously
  console.log(req.body);

  // Immediately acknowledge receipt
  res.status(200).send();
});

@app.route('/webhook-handler', methods=['POST'])
def handle_webhook():
    # Process the result asynchronously
    print(request.json)

    # Immediately acknowledge receipt
    return ('', 200)

import crypto from "crypto";
import express from "express";

const app = express();
const SIGNING_SECRET = process.env.CLORO_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 5 * 60; // reject anything older than 5 minutes

app.post(
  "/webhooks/cloro",
  // IMPORTANT: raw() not json() — we need the exact bytes cloro signed.
  express.raw({ type: "application/json" }),
  (req, res) => {
    const timestamp = req.header("X-Cloro-Timestamp");
    const signatureHeader = req.header("X-Cloro-Signature");
    const rawBody = req.body.toString("utf8");

    if (!timestamp || !signatureHeader) {
      return res.status(400).send("missing signature headers");
    }

    // Replay protection
    const now = Math.floor(Date.now() / 1000);
    if (Math.abs(now - Number(timestamp)) > TOLERANCE_SECONDS) {
      return res.status(400).send("timestamp outside tolerance");
    }

    // Compute the expected signature
    const expected = crypto
      .createHmac("sha256", SIGNING_SECRET)
      .update(`${timestamp}.${rawBody}`)
      .digest("hex");

    const provided = signatureHeader.replace(/^v1=/, "");
    if (
      provided.length !== expected.length ||
      !crypto.timingSafeEqual(
        Buffer.from(expected, "utf8"),
        Buffer.from(provided, "utf8")
      )
    ) {
      return res.status(401).send("invalid signature");
    }

    // Parse JSON only after verification has passed
    const payload = JSON.parse(rawBody);
    // …handle payload…

    res.status(200).send("ok");
  }
);

import hashlib
import hmac
import os
import time
from flask import Flask, request, abort

SIGNING_SECRET = os.environ["CLORO_WEBHOOK_SECRET"].encode()
TOLERANCE_SECONDS = 5 * 60  # reject anything older than 5 minutes

app = Flask(__name__)

@app.route("/webhooks/cloro", methods=["POST"])
def cloro_webhook():
    timestamp = request.headers.get("X-Cloro-Timestamp")
    signature_header = request.headers.get("X-Cloro-Signature", "")
    raw_body = request.get_data()  # bytes, exactly as received

    if not timestamp or not signature_header:
        abort(400, "missing signature headers")

    # Replay protection
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        abort(400, "timestamp outside tolerance")

    # Compute the expected signature
    signed_payload = f"{timestamp}.".encode() + raw_body
    expected = hmac.new(SIGNING_SECRET, signed_payload, hashlib.sha256).hexdigest()

    provided = signature_header.removeprefix("v1=")
    if not hmac.compare_digest(expected, provided):
        abort(401, "invalid signature")

    # Parse the JSON only after verification has passed
    payload = request.get_json(force=True)
    # …handle payload…

    return ("ok", 200)

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

var (
	signingSecret    = []byte(os.Getenv("CLORO_WEBHOOK_SECRET"))
	toleranceSeconds = int64(5 * 60)
)

func cloroWebhook(w http.ResponseWriter, r *http.Request) {
	timestamp := r.Header.Get("X-Cloro-Timestamp")
	signatureHeader := r.Header.Get("X-Cloro-Signature")

	rawBody, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "could not read body", http.StatusBadRequest)
		return
	}

	if timestamp == "" || signatureHeader == "" {
		http.Error(w, "missing signature headers", http.StatusBadRequest)
		return
	}

	// Replay protection
	tsInt, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil || abs(time.Now().Unix()-tsInt) > toleranceSeconds {
		http.Error(w, "timestamp outside tolerance", http.StatusBadRequest)
		return
	}

	// Compute the expected signature
	mac := hmac.New(sha256.New, signingSecret)
	mac.Write([]byte(timestamp + "."))
	mac.Write(rawBody)
	expected := hex.EncodeToString(mac.Sum(nil))

	provided := strings.TrimPrefix(signatureHeader, "v1=")
	if !hmac.Equal([]byte(expected), []byte(provided)) {
		http.Error(w, "invalid signature", http.StatusUnauthorized)
		return
	}

	// Parse JSON / handle payload only after verification has passed
	// …

	w.WriteHeader(http.StatusOK)
	w.Write([]byte("ok"))
}

func abs(n int64) int64 {
	if n < 0 {
		return -n
	}
	return n
}