Webhooks

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const hash = crypto
    .createHmac('sha512', secret)
    .update(JSON.stringify(payload))
    .digest('hex');
  
  return hash === signature;
}

// Usage in your webhook handler
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-webhook-signature'] || req.headers['x-taxstreem-signature'];
  const isValid = verifyWebhookSignature(req.body, signature, process.env.TAXSTREEM_SECRET);
  
  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process the event
  res.status(200).send('OK');
});

import hmac
import hashlib
import json

def verify_webhook_signature(payload, signature, secret):
    hash_obj = hmac.new(
        secret.encode('utf-8'),
        json.dumps(payload).encode('utf-8'),
        hashlib.sha512
    )
    return hash_obj.hexdigest() == signature

# Usage in Flask
@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature') or request.headers.get('x-taxstreem-signature')
    is_valid = verify_webhook_signature(
        request.json, 
        signature, 
        os.environ['TAXSTREEM_SECRET']
    )
    
    if not is_valid:
        return 'Invalid signature', 401
    
    # Process the event
    return 'OK', 200

package main

import (
	"crypto/hmac"
	"crypto/sha512"
	"encoding/hex"
	"encoding/json"
)

func verifyWebhookSignature(payload interface{}, signature, secret string) bool {
	payloadBytes, _ := json.Marshal(payload)
	h := hmac.New(sha512.New, []byte(secret))
	h.Write(payloadBytes)
	computedHash := hex.EncodeToString(h.Sum(nil))
	return computedHash == signature
}

// Usage in HTTP handler
func webhookHandler(w http.ResponseWriter, r *http.Request) {
	signature := r.Header.Get("X-Webhook-Signature")
	if signature == "" {
		signature = r.Header.Get("x-taxstreem-signature")
	}
	var payload map[string]interface{}
	json.NewDecoder(r.Body).Decode(&payload)

	if !verifyWebhookSignature(payload, signature, os.Getenv("TAXSTREEM_SECRET")) {
		http.Error(w, "Invalid signature", http.StatusUnauthorized)
		return
	}

	// Process the event
	w.WriteHeader(http.StatusOK)
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import com.fasterxml.jackson.databind.ObjectMapper;

public class WebhookVerifier {

    private static final ObjectMapper mapper = new ObjectMapper();

    public static boolean verifyWebhookSignature(Object payload, String signature, String secret) throws Exception {
        String payloadJson = mapper.writeValueAsString(payload);
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(payloadJson.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) {
            hex.append(String.format("%02x", b));
        }
        return hex.toString().equals(signature);
    }
}

// Usage in Spring Boot controller
@RestController
public class WebhookController {

    @PostMapping("/webhook")
    public ResponseEntity<String> handleWebhook(
            @RequestHeader(value = "X-Webhook-Signature", required = false) String signature,
            @RequestBody Map<String, Object> payload) throws Exception {

        String secret = System.getenv("TAXSTREEM_SECRET");
        if (!WebhookVerifier.verifyWebhookSignature(payload, signature, secret)) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Invalid signature");
        }

        // Process the event
        return ResponseEntity.ok("OK");
    }
}