Verifying signatures

import crypto from "node:crypto";

const TOLERANCE_SECONDS = 300;

export function verifyXPaySignature(
  rawBody: string,
  header: string | undefined,
  secret: string,
): { valid: boolean; event?: unknown } {
  if (!header) return { valid: false };

  const parts = Object.fromEntries(
    header.split(",").map((p) => {
      const [k, ...rest] = p.split("=");
      return [k, rest.join("=")];
    }),
  );

  const timestamp = Number.parseInt(parts.t ?? "", 10);
  const received = parts.v1;
  if (!Number.isFinite(timestamp) || !received) return { valid: false };

  // Replay protection
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > TOLERANCE_SECONDS) {
    return { valid: false };
  }

  const computed = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(computed);
  const b = Buffer.from(received);
  if (a.length !== b.length) return { valid: false };
  if (!crypto.timingSafeEqual(a, b)) return { valid: false };

  return { valid: true, event: JSON.parse(rawBody) };
}

import hmac, hashlib, time, json

TOLERANCE_SECONDS = 300

def verify_xpay_signature(raw_body: str, header: str, secret: str):
    if not header:
        return None

    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    try:
        timestamp = int(parts["t"])
    except (KeyError, ValueError):
        return None

    received = parts.get("v1", "")
    if not received:
        return None

    # Replay protection
    if abs(time.time() - timestamp) > TOLERANCE_SECONDS:
        return None

    computed = hmac.new(
        secret.encode(),
        f"{timestamp}.{raw_body}".encode(),
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(computed, received):
        return None

    return json.loads(raw_body)

import express from "express";

const app = express();

// IMPORTANT: use express.raw on this exact route, before any global JSON parser.
app.post(
  "/webhooks/xpay",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const rawBody = (req.body as Buffer).toString("utf8");
    const result = verifyXPaySignature(
      rawBody,
      req.header("XPay-Signature"),
      process.env.XPAY_WEBHOOK_SECRET!,
    );
    if (!result.valid) return res.status(400).send("invalid signature");

    handleEvent(result.event);
    res.status(200).send();
  },
);

import Fastify from "fastify";

const fastify = Fastify();

// Register a content-type parser that hands you the raw bytes.
fastify.addContentTypeParser(
  "application/json",
  { parseAs: "string" },
  (_req, body, done) => done(null, body),
);

fastify.post("/webhooks/xpay", async (req, reply) => {
  const rawBody = req.body as string;
  const result = verifyXPaySignature(
    rawBody,
    req.headers["xpay-signature"] as string,
    process.env.XPAY_WEBHOOK_SECRET!,
  );
  if (!result.valid) return reply.code(400).send("invalid signature");

  handleEvent(result.event);
  return reply.code(200).send();
});

// app/api/webhooks/xpay/route.ts
import { NextRequest, NextResponse } from "next/server";

export async function POST(req: NextRequest) {
  const rawBody = await req.text(); // read once, before any .json()
  const result = verifyXPaySignature(
    rawBody,
    req.headers.get("XPay-Signature") ?? undefined,
    process.env.XPAY_WEBHOOK_SECRET!,
  );
  if (!result.valid) {
    return new NextResponse("invalid signature", { status: 400 });
  }

  handleEvent(result.event);
  return new NextResponse(null, { status: 200 });
}