Building a webhook handler

import express from 'express';
import { createHmac, timingSafeEqual } from 'crypto';
 
const app = express();
 
app.post(
  '/webhooks/swappr',
  express.raw({ type: 'application/json' }), // RAW bytes, not JSON
  (req, res) => {
    // 1. Parse the signature header: "t=<unix>,v1=<hex>"
    const header = req.header('x-swappr-signature') ?? '';
    const parts = Object.fromEntries(
      header.split(',').map((kv) => kv.split('=') as [string, string]),
    );
    const ts = parts['t'];
    const sig = parts['v1'];
    if (!ts || !sig) {
      return res.status(400).send('Bad signature header');
    }
 
    // 2. Replay protection: reject anything older than 5 minutes
    const ageSeconds = Math.floor(Date.now() / 1000) - Number(ts);
    if (Number.isNaN(ageSeconds) || ageSeconds > 300) {
      return res.status(401).send('Stale signature');
    }
 
    // 3. Recompute HMAC over `<ts>.<raw_body>` and compare in constant time
    const body = req.body as Buffer; // raw bytes from express.raw()
    const signed = `${ts}.${body.toString('utf8')}`;
    const expected = createHmac('sha256', process.env.SWAPPR_WEBHOOK_SECRET!)
      .update(signed)
      .digest('hex');
    if (
      sig.length !== expected.length ||
      !timingSafeEqual(Buffer.from(sig, 'hex'), Buffer.from(expected, 'hex'))
    ) {
      return res.status(401).send('Invalid signature');
    }
 
    // 4. Parse + ACK fast
    const event = JSON.parse(body.toString('utf8'));
    res.status(200).send('OK'); // ACK FIRST
 
    // 5. Process async — don't block the ACK
    handleEvent(event).catch((err) => {
      console.error('Webhook handler error:', err);
      // Optional: send to your error tracking service
    });
  },
);
 
async function handleEvent(event: any) {
  switch (event.event) {
    case 'wallet_funded':
      await recordInflow(event);
      break;
    case 'payout_paid':
      await markPayoutPaid(event);
      break;
    case 'payout_failed':
      await markPayoutFailed(event);
      break;
    // ... other events
  }
}

import hmac
import hashlib
import os
import time
from flask import Flask, request
 
app = Flask(__name__)
 
@app.route('/webhooks/swappr', methods=['POST'])
def swappr_webhook():
    # 1. Parse signature header: "t=<unix>,v1=<hex>"
    header = request.headers.get('X-Swappr-Signature', '')
    parts = dict(kv.split('=', 1) for kv in header.split(',') if '=' in kv)
    ts = parts.get('t')
    sig = parts.get('v1')
    if not ts or not sig:
        return 'Bad signature header', 400
 
    # 2. Replay protection: reject anything older than 5 minutes
    try:
        age = int(time.time()) - int(ts)
    except ValueError:
        return 'Bad timestamp', 401
    if age > 300:
        return 'Stale signature', 401
 
    # 3. Recompute HMAC over "<ts>.<raw_body>" and compare in constant time
    secret = os.environ['SWAPPR_WEBHOOK_SECRET'].encode('utf-8')
    signed = f"{ts}.".encode('utf-8') + request.data
    expected = hmac.new(secret, signed, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected):
        return 'Invalid signature', 401
 
    # 4. Parse + ACK fast
    event = request.get_json()
 
    # 5. Process async via background queue
    from .tasks import handle_swappr_event
    handle_swappr_event.delay(event)
 
    return 'OK', 200

from fastapi import FastAPI, Request, BackgroundTasks, HTTPException
import hmac
import hashlib
import os
import time
 
app = FastAPI()
 
@app.post('/webhooks/swappr')
async def swappr_webhook(request: Request, bg: BackgroundTasks):
    body_bytes = await request.body()
    header = request.headers.get('x-swappr-signature', '')
 
    parts = dict(kv.split('=', 1) for kv in header.split(',') if '=' in kv)
    ts = parts.get('t')
    sig = parts.get('v1')
    if not ts or not sig:
        raise HTTPException(400, 'Bad signature header')
 
    try:
        age = int(time.time()) - int(ts)
    except ValueError:
        raise HTTPException(401, 'Bad timestamp')
    if age > 300:
        raise HTTPException(401, 'Stale signature')
 
    secret = os.environ['SWAPPR_WEBHOOK_SECRET'].encode('utf-8')
    signed = f"{ts}.".encode('utf-8') + body_bytes
    expected = hmac.new(secret, signed, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected):
        raise HTTPException(401, 'Invalid signature')
 
    event = await request.json()
    bg.add_task(handle_event, event)
 
    return {'received': True}