Receive events with webhooks

const { createHmac, timingSafeEqual } = require("crypto");
const express = require("express");

const SECRET = process.env.FONOSTER_WEBHOOK_SECRET; // whsec_...

function verify(body, headers) {
  const timestamp = Number(headers["x-fonoster-timestamp"]);
  const header = headers["x-fonoster-signature"];
  if (!Number.isFinite(timestamp) || typeof header !== "string") return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) return false;
  const expected = createHmac("sha256", SECRET)
    .update(`${timestamp}.${body}`)
    .digest();
  return header.split(",").some((sig) => {
    const given = Buffer.from(sig.trim(), "hex");
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}

const app = express();

// express.text keeps the body as the raw string that was signed.
app.post("/fonoster", express.text({ type: "application/json" }), (req, res) => {
  if (!verify(req.body, req.headers)) return res.sendStatus(401);
  const event = JSON.parse(req.body);
  res.sendStatus(200);
  handle(event); // Do the work after you answer.
});

function handle(event) {
  console.log(event.type, event.id);
}

app.listen(3000);

import hashlib
import hmac
import os
import time

from flask import Flask, request

SECRET = os.environ["FONOSTER_WEBHOOK_SECRET"].encode()  # whsec_...
app = Flask(__name__)


def verify(body: bytes, headers) -> bool:
    try:
        timestamp = int(headers["X-Fonoster-Timestamp"])
        header = headers["X-Fonoster-Signature"]
    except (KeyError, ValueError):
        return False
    if abs(time.time() - timestamp) > 300:
        return False
    expected = hmac.new(
        SECRET, f"{timestamp}.".encode() + body, hashlib.sha256
    ).hexdigest()
    return any(hmac.compare_digest(sig.strip(), expected) for sig in header.split(","))


@app.post("/fonoster")
def fonoster():
    if not verify(request.get_data(), request.headers):
        return "", 401
    event = request.get_json()
    print(event["type"], event["id"])
    return "", 200