Webhooks

const crypto = require('crypto');

app.post('/webhooks/yativo', express.raw({ type: 'application/json' }), (req, res) => {
  const secret = process.env.YATIVO_WEBHOOK_SECRET;
  const receivedSignature = req.headers['x-yativo-signature'];

  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(req.body) // raw Buffer — do NOT parse before this step
    .digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(expectedSignature),
    Buffer.from(receivedSignature)
  )) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  // safe to process
  res.status(200).send('OK');
});

import hmac
import hashlib
import json
from flask import Flask, request, abort

app = Flask(__name__)

@app.route('/webhooks/yativo', methods=['POST'])
def webhook():
    secret = os.environ['YATIVO_WEBHOOK_SECRET']
    received_signature = request.headers.get('X-Yativo-Signature', '')

    expected_signature = hmac.new(
        secret.encode(),
        request.data,  # raw bytes — do NOT use request.json here
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected_signature, received_signature):
        abort(401)

    event = request.get_json()
    # safe to process
    return 'OK', 200

<?php
$secret = getenv('YATIVO_WEBHOOK_SECRET');
$receivedSignature = $_SERVER['HTTP_X_YATIVO_SIGNATURE'] ?? '';

$payload = file_get_contents('php://input'); // raw body
$expectedSignature = hash_hmac('sha256', $payload, $secret);

if (!hash_equals($expectedSignature, $receivedSignature)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($payload, true);
// safe to process

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "net/http"
    "os"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    secret := []byte(os.Getenv("YATIVO_WEBHOOK_SECRET"))
    receivedSig := r.Header.Get("X-Yativo-Signature")

    body, _ := io.ReadAll(r.Body)

    mac := hmac.New(sha256.New, secret)
    mac.Write(body)
    expectedSig := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(expectedSig), []byte(receivedSig)) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    // safe to process body
    w.WriteHeader(http.StatusOK)
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;

@PostMapping("/webhooks/yativo")
public ResponseEntity<String> webhook(
    @RequestHeader("X-Yativo-Signature") String receivedSignature,
    @RequestBody byte[] rawBody
) throws Exception {
    String secret = System.getenv("YATIVO_WEBHOOK_SECRET");

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(), "HmacSHA256"));
    byte[] rawHmac = mac.doFinal(rawBody);

    StringBuilder hex = new StringBuilder();
    for (byte b : rawHmac) hex.append(String.format("%02x", b));
    String expectedSignature = hex.toString();

    // Constant-time comparison
    if (!MessageDigest.isEqual(
        expectedSignature.getBytes(),
        receivedSignature.getBytes()
    )) {
        return ResponseEntity.status(401).body("Invalid signature");
    }

    // safe to process
    return ResponseEntity.ok("OK");
}

require 'openssl'

post '/webhooks/yativo' do
  secret = ENV['YATIVO_WEBHOOK_SECRET']
  received_signature = request.env['HTTP_X_YATIVO_SIGNATURE']

  payload = request.body.read
  expected_signature = OpenSSL::HMAC.hexdigest('SHA256', secret, payload)

  unless Rack::Utils.secure_compare(expected_signature, received_signature)
    halt 401, 'Invalid signature'
  end

  event = JSON.parse(payload)
  # safe to process
  status 200
end

[HttpPost("/webhooks/yativo")]
public async Task<IActionResult> Webhook()
{
    var secret = Environment.GetEnvironmentVariable("YATIVO_WEBHOOK_SECRET");
    var receivedSignature = Request.Headers["X-Yativo-Signature"].ToString();

    using var reader = new StreamReader(Request.Body);
    var rawBody = await reader.ReadToEndAsync();

    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(rawBody));
    var expectedSignature = BitConverter.ToString(hash).Replace("-", "").ToLower();

    // Constant-time comparison
    if (!CryptographicOperations.FixedTimeEquals(
        Encoding.UTF8.GetBytes(expectedSignature),
        Encoding.UTF8.GetBytes(receivedSignature)
    )) return Unauthorized("Invalid signature");

    // safe to process
    return Ok();
}