Webhook Signatures

import { createHmac, timingSafeEqual } from "crypto";

function verifyImmutableSignature(
  rawBody: string,
  signatureHeader: string,
  secret: string
): boolean {
  const computed = "sha256=" + createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");

  // Constant-time comparison to prevent timing attacks
  if (computed.length !== signatureHeader.length) {
    return false;
  }

  return timingSafeEqual(
    Buffer.from(computed),
    Buffer.from(signatureHeader)
  );
}

// Express.js example
app.post("/webhook/immutable", (req, res) => {
  const rawBody = req.body; // must be raw string, not parsed JSON
  const signature = req.headers["x-immutable-signature"];

  if (!verifyImmutableSignature(rawBody, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  const payload = JSON.parse(rawBody);
  // Process the verified payload
  console.log(payload.event_type); // "alert.triggered" or "event.created"

  res.status(200).send("OK");
});

function verifyImmutableSignature(
    string $rawBody,
    string $signatureHeader,
    string $secret
): bool {
    $computed = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);

    // Constant-time comparison to prevent timing attacks
    return hash_equals($computed, $signatureHeader);
}

// Laravel example
Route::post('/webhook/immutable', function (Request $request) {
    $rawBody = $request->getContent();
    $signature = $request->header('X-Immutable-Signature');
    $secret = config('services.immutable.webhook_secret');

    if (!verifyImmutableSignature($rawBody, $signature, $secret)) {
        abort(401, 'Invalid signature');
    }

    $payload = json_decode($rawBody, true);
    // Process the verified payload
    Log::info('Immutable webhook received', ['type' => $payload['event_type']]);

    return response('OK', 200);
});