Handle Webhooks Securely

import express from "express";
import crypto from "crypto";

const app = express();
const WEBHOOK_SECRET = process.env.BAG_WEBHOOK_SECRET!;
const MAX_SIGNATURE_AGE_S = 300;

app.post(
  "/webhooks/bag",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.headers["x-webhook-signature"] as string;
    const event = req.headers["x-webhook-event"] as string;
    const rawBody = req.body as Buffer;

    const parts = (signature || "").split(",").reduce((acc, part) => {
      const [k, v] = part.split("=");
      if (k && v) acc[k.trim()] = v.trim();
      return acc;
    }, {} as Record<string, string>);

    const t = parts["t"];
    const v1 = parts["v1"];

    const age = Math.floor(Date.now() / 1000) - Number(t);
    if (!t || !v1 || age > MAX_SIGNATURE_AGE_S) {
      res.status(401).json({ error: "Invalid or expired signature" });
      return;
    }

    const expected = crypto
      .createHmac("sha256", WEBHOOK_SECRET)
      .update(`${t}.${rawBody.toString("utf8")}`)
      .digest("hex");

    if (
      v1.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))
    ) {
      res.status(401).json({ error: "Invalid signature" });
      return;
    }

    const payload = JSON.parse(rawBody.toString());

    if (event === "checkout.completed") {
      const { sessionId, txHash, amount, network } = payload.data;
      // Fulfill the order — this is your source of truth
    }

    if (event === "checkout.failed") {
      const { sessionId, reason, message } = payload.data;
      // Notify the customer, surface the reason, allow retry
    }

    if (event === "checkout.cancelled") {
      const { sessionId } = payload.data;
      // Release inventory holds, mark the order cancelled
    }

    if (event === "checkout.expired") {
      const { sessionId, expiresAt } = payload.data;
      // Release inventory holds, optionally email a fresh checkout link
    }

    res.status(200).json({ received: true });
  }
);

app.listen(4000);

import os
import hmac
import hashlib
import json
import time
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = os.environ["BAG_WEBHOOK_SECRET"]
MAX_SIGNATURE_AGE_S = 300


@app.route("/webhooks/bag", methods=["POST"])
def handle_webhook():
    signature = request.headers.get("X-Webhook-Signature", "")
    event = request.headers.get("X-Webhook-Event", "")
    raw_body = request.get_data()

    parts = {}
    for part in signature.split(","):
        if "=" in part:
            k, v = part.split("=", 1)
            parts[k.strip()] = v.strip()

    t = parts.get("t", "")
    v1 = parts.get("v1", "")

    age = int(time.time()) - int(t or "0")
    if not t or not v1 or age > MAX_SIGNATURE_AGE_S:
        return jsonify({"error": "Invalid or expired signature"}), 401

    expected = hmac.new(
        WEBHOOK_SECRET.encode(),
        f"{t}.{raw_body.decode('utf-8')}".encode(),
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, v1):
        return jsonify({"error": "Invalid signature"}), 401

    payload = json.loads(raw_body)

    if event == "checkout.completed":
        data = payload["data"]
        # Fulfill the order — this is your source of truth

    if event == "checkout.failed":
        data = payload["data"]
        # Notify the customer, surface data["reason"] / data["message"]

    if event == "checkout.cancelled":
        data = payload["data"]
        # Release inventory holds, mark the order cancelled

    if event == "checkout.expired":
        data = payload["data"]
        # Release inventory holds, optionally email a fresh checkout link

    return jsonify({"received": True}), 200