Webhook Events

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  // Compute expected signature
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');

  // Use timing-safe comparison to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// Usage in Express handler
app.post('/webhooks/vardacal', express.raw({type: 'application/json'}), (req, res) => {
  const signature = req.headers['x-vardacal-signature'];
  const secret = process.env.WEBHOOK_SECRET; // From webhook creation response

  if (!verifyWebhookSignature(req.body.toString(), signature, secret)) {
    return res.status(401).send('Invalid signature');
  }

  // Signature is valid, process the webhook
  const event = JSON.parse(req.body);
  // ... handle event
});

import hmac
import hashlib

def verify_webhook_signature(payload: bytes, signature: str, secret: str) -> bool:
    """Verify webhook signature using HMAC-SHA256"""
    expected_signature = hmac.new(
        secret.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()

    # Use constant-time comparison to prevent timing attacks
    return hmac.compare_digest(signature, expected_signature)

# Usage in Flask handler
@app.route('/webhooks/vardacal', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-VardaCal-Signature')
    secret = os.environ.get('WEBHOOK_SECRET')
    payload = request.get_data()

    if not verify_webhook_signature(payload, signature, secret):
        return 'Invalid signature', 401

    # Signature is valid, process the webhook
    event = request.get_json()
    # ... handle event

require 'openssl'

def verify_webhook_signature(payload, signature, secret)
  # Compute expected signature
  expected_signature = OpenSSL::HMAC.hexdigest(
    OpenSSL::Digest.new('sha256'),
    secret,
    payload
  )

  # Use constant-time comparison to prevent timing attacks
  ActiveSupport::SecurityUtils.secure_compare(signature, expected_signature)
end

# Usage in Rails controller
class WebhooksController < ApplicationController
  skip_before_action :verify_authenticity_token

  def vardacal
    signature = request.headers['X-VardaCal-Signature']
    secret = ENV['WEBHOOK_SECRET']
    payload = request.raw_post

    unless verify_webhook_signature(payload, signature, secret)
      return head :unauthorized
    end

    # Signature is valid, process the webhook
    event = JSON.parse(payload)
    # ... handle event
  end
end