Introduction

const crypto = require('crypto');
const express = require('express');
const app = express();

// Use express.raw() to capture the exact, raw request body byte-for-byte
app.use('/webhooks', express.raw({ type: 'application/json' }));

app.post('/webhooks', (req, res) => {
  const secret = process.env.SHIFT_WEBHOOK_SECRET; // whsec_...
  const signature = req.headers['x-shift-signature'];
  const eventType = req.headers['x-shift-event'];

  if (!signature || !eventType) {
    return res.status(400).send('Missing headers');
  }

  // Compute HMAC-SHA256 signature using raw body bytes
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(req.body);
  const expectedSignature = hmac.digest('hex');

  // Perform constant-time comparison to prevent timing attacks
  const isMatch = crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );

  if (!isMatch) {
    return res.status(401).send('Invalid signature');
  }

  console.log(`Webhook verified: ${eventType}`);
  res.status(200).send({ received: true });
});

import hmac
import hashlib
from fastapi import FastAPI, Request, Header, HTTPException

app = FastAPI()

@app.post("/webhooks")
async def handle_webhook(
    request: Request,
    x_shift_signature: str = Header(None),
    x_shift_event: str = Header(None)
):
    if not x_shift_signature or not x_shift_event:
        raise HTTPException(status_code=400, detail="Missing headers")
        
    secret = b"whsec_your_secret_here"
    
    # Extract raw request body bytes
    body_bytes = await request.body()
    
    # Compute HMAC-SHA256
    computed_hmac = hmac.new(secret, body_bytes, digestmod=hashlib.sha256)
    expected_signature = computed_hmac.hexdigest()
    
    # Perform constant-time comparison to prevent timing attacks
    if not hmac.compare_digest(x_shift_signature, expected_signature):
        raise HTTPException(status_code=401, detail="Invalid signature")
        
    print(f"Webhook verified: {x_shift_event}")
    return {"received": True}

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"net/http"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	secret := []byte("whsec_your_secret_here")
	signatureHeader := r.Header.Get("X-Shift-Signature")
	eventHeader := r.Header.Get("X-Shift-Event")

	if signatureHeader == "" || eventHeader == "" {
		http.Error(w, "Missing headers", http.StatusBadRequest)
		return
	}

	// Read exact, raw request body
	bodyBytes, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "Read error", http.StatusInternalServerError)
		return
	}

	// Compute HMAC-SHA256 signature
	mac := hmac.New(sha256.New, secret)
	mac.Write(bodyBytes)
	expectedSignature := mac.Sum(nil)

	signatureBytes, err := hex.DecodeString(signatureHeader)
	if err != nil {
		http.Error(w, "Invalid signature format", http.StatusUnauthorized)
		return
	}

	// Perform constant-time comparison to prevent timing attacks
	if !hmac.Equal(signatureBytes, expectedSignature) {
		http.Error(w, "Invalid signature", http.StatusUnauthorized)
		return
	}

	w.WriteHeader(http.StatusOK)
	w.Write([]byte(`{"received":true}`))
}