Webhook secrets

import crypto from "node:crypto";

// Constant-time comparison — a plain === leaks information through timing.
function isValidSignature(received) {
  const expected = process.env.ZEROCASH_WEBHOOK_SECRET;
  if (!received || !expected) return false;

  const a = Buffer.from(received);
  const b = Buffer.from(expected);
  if (a.length !== b.length) return false;

  return crypto.timingSafeEqual(a, b);
}

app.post("/webhooks/zerocash", (req, res) => {
  if (!isValidSignature(req.headers["x-webhook-signature"])) {
    return res.status(401).send("Invalid signature");
  }

  queue.push(req.body);
  res.status(200).end();
});

import hmac
import os
from flask import Flask, request, abort

app = Flask(__name__)

def is_valid_signature(received: str | None) -> bool:
    expected = os.environ.get("ZEROCASH_WEBHOOK_SECRET")
    if not received or not expected:
        return False
    # compare_digest is constant-time
    return hmac.compare_digest(received, expected)

@app.post("/webhooks/zerocash")
def handle_webhook():
    if not is_valid_signature(request.headers.get("X-Webhook-Signature")):
        abort(401)

    enqueue(request.get_json())
    return "", 200

<?php
function is_valid_signature(?string $received): bool {
    $expected = getenv('ZEROCASH_WEBHOOK_SECRET');
    if (!$received || !$expected) {
        return false;
    }
    // hash_equals is constant-time
    return hash_equals($expected, $received);
}

$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? null;

if (!is_valid_signature($signature)) {
    http_response_code(401);
    exit;
}

$payload = json_decode(file_get_contents('php://input'), true);
enqueue($payload);
http_response_code(200);