Create / Update Webhook

const crypto = require('crypto');

app.post('/webhooks/yativo', express.raw({ type: 'application/json' }), (req, res) => {
  const secret = process.env.YATIVO_WEBHOOK_SECRET;
  const receivedSignature = req.headers['x-yativo-signature'];

  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(req.body)
    .digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(expectedSignature),
    Buffer.from(receivedSignature)
  )) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  // safe to process
  res.status(200).send('OK');
});

import hmac, hashlib, os
from flask import Flask, request, abort

@app.route('/webhooks/yativo', methods=['POST'])
def webhook():
    secret = os.environ['YATIVO_WEBHOOK_SECRET']
    received = request.headers.get('X-Yativo-Signature', '')

    expected = hmac.new(
        secret.encode(),
        request.data,
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, received):
        abort(401)

    event = request.get_json()
    return 'OK', 200

$secret = getenv('YATIVO_WEBHOOK_SECRET');
$received = $_SERVER['HTTP_X_YATIVO_SIGNATURE'] ?? '';
$payload  = file_get_contents('php://input');
$expected = hash_hmac('sha256', $payload, $secret);

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($payload, true);

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    secret := []byte(os.Getenv("YATIVO_WEBHOOK_SECRET"))
    received := r.Header.Get("X-Yativo-Signature")
    body, _ := io.ReadAll(r.Body)

    mac := hmac.New(sha256.New, secret)
    mac.Write(body)
    expected := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(expected), []byte(received)) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }
    w.WriteHeader(http.StatusOK)
}

Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(secret.getBytes(), "HmacSHA256"));
byte[] rawHmac = mac.doFinal(rawBody);

StringBuilder hex = new StringBuilder();
for (byte b : rawHmac) hex.append(String.format("%02x", b));
String expected = hex.toString();

if (!MessageDigest.isEqual(expected.getBytes(), received.getBytes())) {
    return ResponseEntity.status(401).body("Invalid signature");
}

expected = OpenSSL::HMAC.hexdigest('SHA256', secret, payload)
unless Rack::Utils.secure_compare(expected, received)
  halt 401, 'Invalid signature'
end

using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(rawBody));
var expected = BitConverter.ToString(hash).Replace("-", "").ToLower();

if (!CryptographicOperations.FixedTimeEquals(
    Encoding.UTF8.GetBytes(expected),
    Encoding.UTF8.GetBytes(received)
)) return Unauthorized();