1{
2  "code": 0,
3  "message": "OK",
4  "data": {
5    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MjU4NzM0NzQsInN1YiI6IjE1MjA2Njg0MDM0NzA2MjI3MyIsImFwcElkIjoiMTUyMDY2ODQwMzQ3MDYyMjc1Iiwic2NvcGVzIjpbIndvcmtmbG93VGFzay5jcmVhdGUiLCJ3b3JrZmxvd1Rhc2sucmVhZCJdfQ.lMNLQCDfCE24f8FT3ixzDvB7rFtGLkC9wtBYyRF7IF8",
6    "token_type": "Bearer",
7    "expires_in": 7199,
8    "scope": "workflowTask.write workflowTask.read",
9    "app_id": "152066840347062275"
10  }
11}

1package com.example.springboot.controller;
2
3import org.apache.commons.codec.digest.HmacAlgorithms;
4import org.apache.commons.codec.digest.HmacUtils;
5import org.slf4j.Logger;
6import org.slf4j.LoggerFactory;
7import org.springframework.http.HttpStatus;
8import org.springframework.web.bind.annotation.*;
9import org.springframework.web.server.ResponseStatusException;
10
11import jakarta.servlet.http.HttpServletRequest;
12
13import java.io.IOException;
14import java.util.*;
15import java.util.stream.Collectors;
16
17@RestController
18public class WebhookController {
19
20    private static final Logger logger = LoggerFactory.getLogger(WebhookController.class);
21
22    private static final String HEADER_TIMESTAMP_KEY = "X-Meowflow-Timestamp";
23    private static final String HEADER_SIGNATURE_KEY = "X-Meowflow-Signature";
24    private static final String QUERY_KEY_TIMESTAMP = "meowflow_timestamp";
25    private static final String QUERY_KEY_SIGNATURE = "meowflow_signature";
26    private static final long TIMESTAMP_EXPIRED_TIME = 300000; // 5 minutes
27
28    /**
29     * TODO:: need to replace with your app secret key from your Meowflow app
30     */
31    private final String secret = "your app secret";
32
33    @RequestMapping(value = "/api/webhook", method = {RequestMethod.GET, RequestMethod.POST, RequestMethod.PUT, RequestMethod.PATCH, RequestMethod.DELETE})
34    public Map<String, String> handle(HttpServletRequest request) {
35        try {
36            verifySignature(request);
37        } catch (VerifySignatureException e) {
38            throw new ResponseStatusException(HttpStatus.FORBIDDEN, e.getMessage());
39        } catch (Exception e) {
40            logger.error("Unknown error: {}", e.getMessage(), e);
41            throw new ResponseStatusException(HttpStatus.INTERNAL_SERVER_ERROR, "Internal server error");
42        }
43
44        //  TODO:: do something with the request here...
45        logger.info("----------- received signature request -----------");
46        return Map.of("message", "OK");
47    }
48
49    private void verifySignature(HttpServletRequest request) throws VerifySignatureException, IOException {
50        Map<String, String> signatureFields = getSignatureFields(request);
51        String timestamp = signatureFields.get(QUERY_KEY_TIMESTAMP);
52        String signature = signatureFields.get(QUERY_KEY_SIGNATURE);
53        checkSignatureBaseFields(timestamp, signature);
54
55        String contents = buildSignatureContents(request, timestamp);
56        if (!compareSignature(signature, contents)) {
57            throw new VerifySignatureException("Signature verification failed");
58        }
59    }
60
61    private Map<String, String> getSignatureFields(HttpServletRequest request) {
62        String timestamp;
63        String signature;
64
65        if (isUrlDigest(request.getMethod())) {
66            timestamp = Optional.ofNullable(request.getParameter(QUERY_KEY_TIMESTAMP))
67                    .orElse(request.getHeader(HEADER_TIMESTAMP_KEY));
68            signature = Optional.ofNullable(request.getParameter(QUERY_KEY_SIGNATURE))
69                    .orElse(request.getHeader(HEADER_SIGNATURE_KEY));
70        } else {
71            timestamp = request.getHeader(HEADER_TIMESTAMP_KEY);
72            signature = request.getHeader(HEADER_SIGNATURE_KEY);
73        }
74
75        return Map.of(
76                QUERY_KEY_TIMESTAMP, Optional.ofNullable(timestamp).orElse(""),
77                QUERY_KEY_SIGNATURE, Optional.ofNullable(signature).orElse("")
78        );
79    }
80
81    private String buildSignatureContents(HttpServletRequest request, String timestamp) throws IOException {
82        StringBuilder contents = new StringBuilder(request.getMethod())
83                .append(" ")
84            .append(Optional.ofNullable(request.getServerName())
85                    .map(name -> {
86                        int port = request.getServerPort();
87                        boolean isNonStandardPort = (port != 80 && port != 443) ||
88                                (port == 80 && request.isSecure()) ||
89                                (port == 443 && !request.isSecure());
90                        return isNonStandardPort ? name + ":" + port : name;
91                    })
92                    .orElse(""))
93            .append(request.getRequestURI());
94    if (isUrlDigest(request.getMethod())) {
95        String queryParams = buildUrlSignatureContent(request, timestamp);
96        contents.append("?").append(queryParams);
97    } else {
98        contents.append(" ");
99        if (request.getContentLength() > 0) {
100            contents.append(request.getReader().lines().collect(Collectors.joining()));
101        }
102        contents.append(timestamp);
103    }
104    return contents.toString();
105}
106
107    private String buildUrlSignatureContent(HttpServletRequest request, String timestamp) {
108        Map<String, List<String>> parameterMap = new TreeMap<>();
109
110        request.getParameterMap().forEach((key, values) -> {
111            if (!QUERY_KEY_SIGNATURE.equals(key)) {
112                parameterMap.put(key, Arrays.asList(values));
113            }
114        });
115
116        if (!parameterMap.containsKey(QUERY_KEY_TIMESTAMP)) {
117            parameterMap.put(QUERY_KEY_TIMESTAMP, Collections.singletonList(timestamp));
118        }
119
120        return parameterMap.entrySet().stream()
121                .flatMap(entry -> entry.getValue().stream()
122                        .map(value -> entry.getKey() + "=" + value))
123                .sorted()
124                .collect(Collectors.joining("&"));
125    }
126
127    private void checkSignatureBaseFields(String timestamp, String signature) throws VerifySignatureException {
128        if (timestamp.isEmpty()) {
129            throw new VerifySignatureException("Missing timestamp");
130        }
131        if (signature.isEmpty()) {
132            throw new VerifySignatureException("Missing signature");
133        }
134        if (!isTimestampValid(timestamp)) {
135            throw new VerifySignatureException("Timestamp is invalid");
136        }
137    }
138
139    private boolean isTimestampValid(String timestamp) {
140        long timestampMilli = Long.parseLong(timestamp);
141        long currentTimeMilli = System.currentTimeMillis();
142        return timestampMilli > 0 && (currentTimeMilli - timestampMilli) <= TIMESTAMP_EXPIRED_TIME;
143    }
144
145    private boolean isUrlDigest(String method) {
146        return method.isEmpty() || method.equals("GET") || method.equals("DELETE");
147    }
148
149    private boolean compareSignature(String signature, String contents) {
150        String calculatedSignature = new HmacUtils(HmacAlgorithms.HMAC_SHA_256, secret).hmacHex(contents);
151
152        // log for debug
153        logger.warn("Signature: contents={}, signature={}, hash={}, secret={}",
154                contents, signature, calculatedSignature, secret);
155
156        return calculatedSignature.equals(signature);
157    }
158
159    private static class VerifySignatureException extends Exception {
160        public VerifySignatureException(String message) {
161            super(message);
162        }
163    }
164}

1<?php
2declare(strict_types=1);
3
4namespace App\Http\Controllers;
5
6use Exception;
7use Illuminate\Http\JsonResponse;
8use Illuminate\Http\Request;
9use Illuminate\Support\Facades\Log;
10use Symfony\Component\HttpFoundation\InputBag;
11
12class VerifySignatureException extends Exception
13{
14}
15
16class WebhookController extends Controller
17{
18    private const HEADER_TIMESTAMP_KEY = 'X-Meowflow-Timestamp';
19    private const HEADER_SIGNATURE_KEY = 'X-Meowflow-Signature';
20    private const QUERY_KEY_TIMESTAMP = 'meowflow_timestamp';
21    private const QUERY_KEY_SIGNATURE = 'meowflow_signature';
22    private const TIMESTAMP_EXPIRED_TIME = 300000; // 5 minutes
23
24    /**
25     * TODO:: need to replace with your app secret key from your Meowflow app
26     *
27     * @var string your app secret
28     */
29    private string $secret = 'your app secret';
30
31    public function handle(Request $request): JsonResponse
32    {
33        try {
34            $this->verifySignature($request);
35        } catch (VerifySignatureException $e) {
36            return response()->json(['message' => $e->getMessage()], 403);
37        } catch (Exception $e) {
38            Log::error('Unknown error: ' . $e->getMessage(), ['trace' => $e->getTraceAsString()]);
39            return response()->json(['message' => 'Internal server error'], 500);
40        }
41
42        // TODO:: do something with the request here...
43        Log::info('----------- received signature request -----------');
44        return response()->json(['message' => 'OK']);
45    }
46
47    /**
48     * @throws VerifySignatureException
49     */
50    private function verifySignature(Request $request): void
51    {
52        [$timestamp, $signature] = $this->getSignatureFields($request);
53        $this->checkSignatureBaseFields($timestamp, $signature);
54
55        $contents = $this->buildSignatureContents($request, $timestamp);
56        if (!$this->compareSignature($signature, $contents)) {
57            throw new VerifySignatureException('Signature verification failed');
58        }
59    }
60
61    /**
62     * @param Request $request
63     * @return array<string>
64     */
65    private function getSignatureFields(Request $request): array
66    {
67        if ($this->isUrlDigest($request->getMethod())) {
68            $timestamp = $request->query->getString(self::QUERY_KEY_TIMESTAMP, $request->headers->get(self::HEADER_TIMESTAMP_KEY));
69            $signature = $request->query->getString(self::QUERY_KEY_SIGNATURE, $request->headers->get(self::HEADER_SIGNATURE_KEY));
70        } else {
71            $timestamp = $request->headers->get(self::HEADER_TIMESTAMP_KEY);
72            $signature = $request->headers->get(self::HEADER_SIGNATURE_KEY);
73        }
74
75        return [
76            $timestamp ?? '',
77            $signature ?? ''
78        ];
79    }
80
81    private function buildSignatureContents(Request $request, string $timestamp): string
82    {
83        $method = $request->getMethod();
84        $contents = $method . ' ' . $request->getHttpHost() . $request->getPathInfo();
85
86        if ($this->isUrlDigest($method)) {
87            $contents .= '?' . $this->buildUrlSignatureContent($request->query, $timestamp);
88        } else {
89            $contents .= ' ' . $request->getContent() . $timestamp;
90        }
91
92        return $contents;
93    }
94
95    private function buildUrlSignatureContent(InputBag $query, string $timestamp): string
96    {
97        $params = [];
98        foreach ($query as $key => $value) {
99            if ($key !== self::QUERY_KEY_SIGNATURE) {
100                $params[$key] = is_array($value) ? implode(',', $value) : (string)$value;
101            }
102        }
103        $params[self::QUERY_KEY_TIMESTAMP] ??= $timestamp;
104
105        ksort($params);
106        return http_build_query($params);
107    }
108
109    private function checkSignatureBaseFields(string $timestamp, string $signature): void
110    {
111        if (empty($timestamp)) {
112            throw new VerifySignatureException('Missing timestamp');
113        }
114        if (empty($signature)) {
115            throw new VerifySignatureException('Missing signature');
116        }
117        if (!$this->isTimestampValid($timestamp)) {
118            throw new VerifySignatureException('Timestamp is invalid');
119        }
120    }
121
122    private function isTimestampValid(string $timestamp): bool
123    {
124        $timestampMilli = (int)$timestamp;
125        $currentTimeMilli = (int)(microtime(true) * 1000);
126        return $timestampMilli > 0 && ($currentTimeMilli - $timestampMilli) <= self::TIMESTAMP_EXPIRED_TIME;
127    }
128
129    private function isUrlDigest(string $method): bool
130    {
131        return empty($method) || $method === 'GET' || $method === 'DELETE';
132    }
133
134    private function compareSignature(string $signature, string $contents): bool
135    {
136        $calculatedSignature = hash_hmac('sha256', $contents, $this->secret);
137
138        // log for debug
139        Log::warning('Signature: ', [
140            'contents' => $contents,
141            'signature' => $signature,
142            'hash' => $calculatedSignature,
143            'secret' => $this->secret
144        ]);
145
146        return hash_equals($calculatedSignature, $signature);
147    }
148}

1import hmac
2import hashlib
3import time
4
5from flask import Flask, request, jsonify
6from typing import Tuple
7
8app = Flask(__name__)
9
10
11class VerifySignatureException(Exception):
12    pass
13
14
15class WebhookController:
16    HEADER_TIMESTAMP_KEY = 'X-Meowflow-Timestamp'
17    HEADER_SIGNATURE_KEY = 'X-Meowflow-Signature'
18    QUERY_KEY_TIMESTAMP = 'meowflow_timestamp'
19    QUERY_KEY_SIGNATURE = 'meowflow_signature'
20    TIMESTAMP_EXPIRED_TIME = 300000  # 5 minutes
21
22    def __init__(self):
23        # TODO:: need to replace with your app secret key from your Meowflow app
24        self.secret = 'your app secret'
25
26    @staticmethod
27    @app.route('/api/webhook', methods=['GET', 'POST', 'PUT', 'PATCH', 'DELETE'])
28    def handle():
29        controller = WebhookController()
30        try:
31            controller.verify_signature()
32        except VerifySignatureException as e:
33            return jsonify({'message': str(e)}), 403
34        except Exception as e:
35            app.logger.error(f'Unknown error: {str(e)}')
36            return jsonify({'message': 'Internal server error'}), 500
37
38        # TODO:: do something with the request here...
39        app.logger.warning('----------- received signature request -----------')
40        return jsonify({'message': 'OK'})
41
42    def verify_signature(self) -> None:
43        timestamp, signature = self.get_signature_fields()
44        self.check_signature_base_fields(timestamp, signature)
45        contents = self.build_signature_contents(timestamp)
46        if not self.compare_signature(signature, contents):
47            raise VerifySignatureException('Signature verification failed')
48
49    def get_signature_fields(self) -> Tuple[str, str]:
50        if self.is_url_digest(request.method):
51            timestamp = request.args.get(self.QUERY_KEY_TIMESTAMP) or request.headers.get(self.HEADER_TIMESTAMP_KEY, '')
52            signature = request.args.get(self.QUERY_KEY_SIGNATURE) or request.headers.get(self.HEADER_SIGNATURE_KEY, '')
53        else:
54            timestamp = request.headers.get(self.HEADER_TIMESTAMP_KEY, '')
55            signature = request.headers.get(self.HEADER_SIGNATURE_KEY, '')
56        return timestamp, signature
57
58    def build_signature_contents(self, timestamp: str) -> str:
59        method = request.method
60        contents = f"{method} {request.host}{request.path}"
61        if self.is_url_digest(method):
62            query_params = self.build_url_signature_content(timestamp)
63            contents += f"?{query_params}"
64        else:
65            contents += " "
66            if request.data:
67                contents += f"{request.data.decode('utf-8')}"
68            contents += f" {timestamp}"
69        return contents
70
71    def build_url_signature_content(self, timestamp: str) -> str:
72        params = {k: v for k, v in request.args.lists() if k != self.QUERY_KEY_SIGNATURE}
73        if self.QUERY_KEY_TIMESTAMP not in params:
74            params[self.QUERY_KEY_TIMESTAMP] = [timestamp]
75        params = {k: ','.join(v) for k, v in params.items()}
76
77        return '&'.join(f"{k}={v}" for k, v in sorted(params.items()))
78
79    def check_signature_base_fields(self, timestamp: str, signature: str) -> None:
80        if not timestamp:
81            raise VerifySignatureException('Missing timestamp')
82        if not signature:
83            raise VerifySignatureException('Missing signature')
84        if not self.is_timestamp_valid(timestamp):
85            raise VerifySignatureException('Timestamp is invalid')
86
87    def is_timestamp_valid(self, timestamp: str) -> bool:
88        timestamp_milli = int(timestamp)
89        current_time_milli = int(time.time() * 1000)
90        return timestamp_milli > 0 and (current_time_milli - timestamp_milli) <= self.TIMESTAMP_EXPIRED_TIME
91
92    @staticmethod
93    def is_url_digest(method: str) -> bool:
94        return not method or method in ['GET', 'DELETE']
95
96    def compare_signature(self, signature: str, contents: str) -> bool:
97        expected_signature = hmac.new(self.secret.encode(), contents.encode(), hashlib.sha256).hexdigest()
98
99        # log for debug
100        app.logger.warning('Signature: contents=%s, signature=%s, hash=%s, secret=%s',
101                           contents, signature, expected_signature, self.secret
102                           )
103
104        return hmac.compare_digest(expected_signature, signature)
105
106
107if __name__ == '__main__':
108    app.run(debug=True)

1package main
2
3import (
4    "bytes"
5    "crypto/hmac"
6    "crypto/sha256"
7    "encoding/hex"
8    "errors"
9    "fmt"
10    "io"
11    "log"
12    "log/slog"
13    "net/http"
14    "net/url"
15    "slices"
16    "strconv"
17    "strings"
18    "time"
19)
20
21const (
22    headerTimestampKey   = "X-Meowflow-Timestamp"
23    headerSignatureKey   = "X-Meowflow-Signature"
24    queryKeyTimestamp    = "meowflow_timestamp"
25    queryKeySignature    = "meowflow_signature"
26    timestampExpiredTime = 300000 // 5 minutes
27)
28
29// TODO:: need to replace with your app secret key from your Meowflow app
30var secret = "your app secret"
31
32type verifySignatureError struct {
33    message string
34}
35
36func (e *verifySignatureError) Error() string {
37    if e == nil {
38        return ""
39    }
40    return e.message
41}
42
43func handleWebhook(w http.ResponseWriter, r *http.Request) {
44    if err := verifySignature(r); err != nil {
45        var (
46            statusCode int
47            message    string
48        )
49        if se := new(verifySignatureError); errors.As(err, &se) {
50            message = se.message
51            statusCode = http.StatusForbidden
52        } else {
53            message = "Internal Server Error"
54            statusCode = http.StatusInternalServerError
55            slog.Error(fmt.Sprintf("Unknown error: %+v", err))
56        }
57        responseJson(w, statusCode, message)
58        return
59    }
60
61    // TODO:: do something with the request here...
62    slog.Info("----------- received signature request -----------")
63    responseJson(w, http.StatusOK, "OK")
64}
65
66func responseJson(w http.ResponseWriter, statusCode int, message string) {
67    w.Header().Set("Content-Type", "application/json; charset=utf-8")
68    w.WriteHeader(statusCode)
69    w.Write([]byte(fmt.Sprintf(`{"message":"%s"}`, message)))
70}
71
72func verifySignature(r *http.Request) error {
73    timestamp, signature := getSignatureFields(r)
74    if err := checkSignatureBaseFields(timestamp, signature); err != nil {
75        return err
76    }
77
78    contents := buildSignatureContents(r, timestamp)
79    if !compareSignature([]byte(signature), contents) {
80        return &verifySignatureError{message: "signature verification failed"}
81    }
82    return nil
83}
84
85func getSignatureFields(r *http.Request) (timestamp string, signature string) {
86    if isURLDigest(r.Method) {
87        timestamp = r.URL.Query().Get(queryKeyTimestamp)
88        if timestamp == "" {
89            timestamp = r.Header.Get(headerTimestampKey)
90        }
91        signature = r.URL.Query().Get(queryKeySignature)
92        if signature == "" {
93            signature = r.Header.Get(headerSignatureKey)
94        }
95        return timestamp, signature
96    }
97    return r.Header.Get(headerTimestampKey), r.Header.Get(headerSignatureKey)
98}
99
100func buildSignatureContents(r *http.Request, timestamp string) []byte {
101    var buf bytes.Buffer
102    buf.WriteString(r.Method)
103    buf.WriteString(" ")
104    if r.URL.Host != "" {
105        buf.WriteString(r.URL.Host)
106    } else {
107        buf.WriteString(r.Host)
108    }
109    path := r.URL.Path
110    if path == "" {
111        path = "/"
112    } else if !strings.HasPrefix(path, "/") {
113        path = "/" + path
114    }
115    buf.WriteString(path)
116
117    if isURLDigest(r.Method) {
118        b := buildURLSignatureContent(r.URL.Query(), timestamp)
119        buf.WriteString("?")
120        buf.Write(b)
121    } else {
122        bodyBytes, _ := io.ReadAll(r.Body)
123        r.Body = io.NopCloser(bytes.NewBuffer(bodyBytes)) // reset body
124        buf.WriteString(" ")
125        buf.Write(bodyBytes)
126        buf.WriteString(timestamp)
127    }
128    return buf.Bytes()
129}
130
131func buildURLSignatureContent(query url.Values, timestamp string) []byte {
132    params := make(url.Values)
133    for key, values := range query {
134        if key != queryKeySignature {
135            params[key] = values
136        }
137    }
138
139    if !params.Has(queryKeyTimestamp) {
140        params.Set(queryKeyTimestamp, timestamp)
141    }
142
143    keys := make([]string, 0, len(params))
144    for k := range params {
145        keys = append(keys, k)
146    }
147    slices.Sort(keys)
148    var buf bytes.Buffer
149    for _, k := range keys {
150        buf.WriteString(k)
151        buf.WriteString("=")
152        buf.WriteString(strings.Join(params[k], ","))
153        buf.WriteString("&")
154    }
155    if buf.Len() > 0 {
156        buf.Truncate(buf.Len() - 1) // remove last "&"
157    }
158    return buf.Bytes()
159}
160
161func checkSignatureBaseFields(timestamp, signature string) error {
162    if timestamp == "" {
163        return &verifySignatureError{message: "missing timestamp"}
164    }
165    if signature == "" {
166        return &verifySignatureError{message: "missing signature"}
167    }
168    if !isTimestampValid(timestamp) {
169        return &verifySignatureError{message: "timestamp is invalid"}
170    }
171    return nil
172}
173
174func isTimestampValid(timestamp string) bool {
175    timestampMilli, err := strconv.ParseInt(timestamp, 10, 64)
176    if err != nil {
177        return false
178    }
179    currentTimeMilli := time.Now().UnixMilli()
180    return timestampMilli > 0 && (currentTimeMilli-timestampMilli) <= timestampExpiredTime
181}
182
183func isURLDigest(method string) bool {
184    return method == "" || method == http.MethodGet || method == http.MethodDelete
185}
186
187func compareSignature(signature, contents []byte) bool {
188    h := hmac.New(sha256.New, []byte(secret))
189    h.Write(contents)
190    calculatedSignature := hex.EncodeToString(h.Sum(nil))
191
192    // log for debug
193    slog.Warn(fmt.Sprintf("Signature: contents=%s, signature=%s, hash=%s, secret=%s",
194        contents, signature, calculatedSignature, secret))
195
196    return hmac.Equal([]byte(calculatedSignature), signature)
197}
198
199func main() {
200    http.HandleFunc("/api/webhook", handleWebhook)
201    slog.Info("Server is running on http://127.0.0.1:8080")
202    log.Fatalln(http.ListenAndServe(":8080", nil))
203}

1import {createHmac} from 'crypto';
2
3export function sign(secret: string, contents: string): string {
4  return createHmac('sha256', secret).update(contents).digest('hex');
5}

1import {Request, Response} from 'express';
2import crypto from 'crypto';
3import {ParsedQs} from "qs";
4
5class VerifySignatureError extends Error {
6    constructor(message: string) {
7        super(message);
8        this.name = 'VerifySignatureError';
9    }
10}
11
12export class WebhookController {
13    private static readonly HEADER_TIMESTAMP_KEY = 'X-Meowflow-Timestamp';
14    private static readonly HEADER_SIGNATURE_KEY = 'X-Meowflow-Signature';
15    private static readonly QUERY_KEY_TIMESTAMP = 'meowflow_timestamp';
16    private static readonly QUERY_KEY_SIGNATURE = 'meowflow_signature';
17    private static readonly TIMESTAMP_EXPIRED_TIME = 300000; // 5 minutes
18
19
20    /**
21     * TODO:: need to replace with your app secret key from your Meowflow app
22     *
23     * @var string your app secret
24     */
25    private readonly secret: string = 'your app secret';
26
27
28    public async handle(req: Request, res: Response): Promise<Response> {
29        try {
30            await this.verifySignature(req);
31        } catch (e) {
32            if (e instanceof VerifySignatureError) {
33                return res.status(403).json({message: e.message});
34            }
35            console.error('Unknown error: ', e);
36            return res.status(500).json({message: 'Internal server error'});
37        }
38
39        // TODO:: do something with the request here...
40        console.log('----------- received signature request -----------');
41        return res.json({message: 'OK'});
42    }
43
44    private async verifySignature(req: Request): Promise<void> {
45        const {timestamp, signature} = this.getSignatureFields(req);
46        this.checkSignatureBaseFields(timestamp, signature);
47
48        const contents = this.buildSignatureContents(req, timestamp);
49        if (!this.compareSignature(signature, contents)) {
50            throw new VerifySignatureError("Signature verification failed");
51        }
52    }
53
54    private getSignatureFields(req: Request): { timestamp: string; signature: string } {
55        let timestamp: string | undefined;
56        let signature: string | undefined;
57
58        if (this.isUrlDigest(req.method)) {
59            timestamp = (req.query[WebhookController.QUERY_KEY_TIMESTAMP] as string) || req.header(WebhookController.HEADER_TIMESTAMP_KEY);
60            signature = (req.query[WebhookController.QUERY_KEY_SIGNATURE] as string) || req.header(WebhookController.HEADER_SIGNATURE_KEY);
61        } else {
62            timestamp = req.header(WebhookController.HEADER_TIMESTAMP_KEY);
63            signature = req.header(WebhookController.HEADER_SIGNATURE_KEY);
64        }
65
66        return {
67            timestamp: timestamp || '',
68            signature: signature || ''
69        };
70    }
71
72    private buildSignatureContents(req: Request, timestamp: string): string {
73        const {method, path, query} = req;
74        const host = req.header('host') || '';
75        let contents = `${method} ${host}${path}`;
76
77        if (this.isUrlDigest(method)) {
78            const queryParams = this.buildUrlSignatureContent(query, timestamp);
79            contents += `?${queryParams}`;
80        } else {
81            const rawBody = (req as any).rawBody;
82            if (rawBody) {
83                contents += ` ${rawBody.toString()}${timestamp}`;
84            } else {
85                contents += ` ${timestamp}`;
86            }
87        }
88
89        return contents;
90    }
91
92    private buildUrlSignatureContent(query: ParsedQs, timestamp: string): string {
93        const params: Record<string, string> = Object.fromEntries(
94            Object.entries(query)
95                .filter(([key]) => key !== WebhookController.QUERY_KEY_SIGNATURE)
96                .map(([key, value]) => [
97                    key,
98                    Array.isArray(value) ? value.join(',') : String(value)
99                ])
100        );
101
102        params[WebhookController.QUERY_KEY_TIMESTAMP] ??= timestamp;
103
104        const sortedParams = Object.fromEntries(
105            Object.entries(params).sort(([a], [b]) => a.localeCompare(b))
106        );
107
108        return new URLSearchParams(sortedParams).toString();
109    }
110
111    private checkSignatureBaseFields(timestamp: string, signature: string): void {
112        if (!timestamp) {
113            throw new VerifySignatureError("Missing timestamp");
114        }
115        if (!signature) {
116            throw new VerifySignatureError("Missing signature");
117        }
118        if (!this.isTimestampValid(timestamp)) {
119            throw new VerifySignatureError("Timestamp is invalid");
120        }
121    }
122
123    private isTimestampValid(timestamp: string): boolean {
124        const timestampMilli = parseInt(timestamp, 10);
125        return !isNaN(timestampMilli) && timestampMilli > 0 &&
126            (Date.now() - timestampMilli) <= WebhookController.TIMESTAMP_EXPIRED_TIME;
127    }
128
129    private isUrlDigest(method?: string): boolean {
130        return !method || method === 'GET' || method === 'DELETE';
131    }
132
133    private compareSignature(signature: string, contents: string): boolean {
134        const expectedSignature = crypto.createHmac('sha256', this.secret).update(contents).digest('hex')
135
136        // log for debug
137        console.log('Signature: ', {
138            contents: contents,
139            signature: signature,
140            hash: expectedSignature,
141            secret: this.secret
142        });
143
144        return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature));
145    }
146}