Webhooks

import hmac
import hashlib
import time

def verify_enclave_webhook(
    secret: str,
    headers: dict,
    raw_body: bytes,
    max_age_seconds: int = 300,
) -> bool:
    ts  = headers.get("X-Enclave-Timestamp", "")
    sig = headers.get("X-Enclave-Signature", "")  # "sha256=<hex>"

    # Reject replays older than max_age_seconds (default 5 minutes).
    try:
        if abs(time.time() - int(ts)) > max_age_seconds:
            return False
    except ValueError:
        return False

    message  = f"{ts}.".encode() + raw_body
    expected = "sha256=" + hmac.new(
        secret.encode(), message, hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(expected, sig)

import crypto from "crypto";

function verifyEnclaveWebhook(
  secret: string,
  headers: Record<string, string>,
  rawBody: Buffer,
  maxAgeSeconds = 300,
): boolean {
  const ts  = headers["x-enclave-timestamp"] ?? "";
  const sig = headers["x-enclave-signature"] ?? "";  // "sha256=<hex>"

  // Reject replays older than maxAgeSeconds (default 5 minutes).
  if (Math.abs(Date.now() / 1000 - Number(ts)) > maxAgeSeconds) return false;

  const message  = `${ts}.${rawBody.toString()}`;
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(message)
    .digest("hex");

  // timingSafeEqual requires equal-length buffers.
  const a = Buffer.from(expected);
  const b = Buffer.from(sig);
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"math"
	"net/http"
	"strconv"
	"strings"
	"time"
)

func verifyEnclaveWebhook(secret string, r *http.Request, rawBody []byte) bool {
	ts  := r.Header.Get("X-Enclave-Timestamp")
	sig := r.Header.Get("X-Enclave-Signature") // "sha256=<hex>"

	// Reject replays older than 5 minutes.
	epoch, err := strconv.ParseInt(ts, 10, 64)
	if err != nil {
		return false
	}
	if math.Abs(float64(time.Now().Unix()-epoch)) > 300 {
		return false
	}

	message := ts + "." + string(rawBody)
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(message))
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))

	return hmac.Equal([]byte(expected), []byte(sig))
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;

public class EnclaveWebhookVerifier {

    public static boolean verify(
            String secret,
            String timestamp,
            String signature,   // "sha256=<hex>"
            byte[] rawBody
    ) throws Exception {
        // Reject replays older than 5 minutes.
        long epoch = Long.parseLong(timestamp);
        if (Math.abs(Instant.now().getEpochSecond() - epoch) > 300) {
            return false;
        }

        String message = timestamp + "." + new String(rawBody, StandardCharsets.UTF_8);
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] hash = mac.doFinal(message.getBytes(StandardCharsets.UTF_8));

        String expected = "sha256=" + bytesToHex(hash);

        // Constant-time comparison.
        return MessageDigest.isEqual(
            expected.getBytes(StandardCharsets.UTF_8),
            signature.getBytes(StandardCharsets.UTF_8)
        );
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder(bytes.length * 2);
        for (byte b : bytes) sb.append(String.format("%02x", b));
        return sb.toString();
    }
}

using System;
using System.Security.Cryptography;
using System.Text;

public static class EnclaveWebhookVerifier
{
    public static bool Verify(
        string secret,
        string timestamp,
        string signature,   // "sha256=<hex>"
        byte[] rawBody,
        int maxAgeSeconds = 300)
    {
        // Reject replays older than maxAgeSeconds.
        if (!long.TryParse(timestamp, out long epoch)) return false;
        var age = Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - epoch);
        if (age > maxAgeSeconds) return false;

        var message  = Encoding.UTF8.GetBytes($"{timestamp}.{Encoding.UTF8.GetString(rawBody)}");
        var keyBytes = Encoding.UTF8.GetBytes(secret);

        using var hmac = new HMACSHA256(keyBytes);
        var hash     = hmac.ComputeHash(message);
        var expected = "sha256=" + Convert.ToHexString(hash).ToLowerInvariant();

        // CryptographicOperations.FixedTimeEquals prevents timing attacks.
        return CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(expected),
            Encoding.UTF8.GetBytes(signature)
        );
    }
}

<?php

function verifyEnclaveWebhook(
    string $secret,
    string $timestamp,
    string $signature,   // "sha256=<hex>"
    string $rawBody,
    int    $maxAgeSeconds = 300
): bool {
    // Reject replays older than $maxAgeSeconds.
    if (abs(time() - (int) $timestamp) > $maxAgeSeconds) {
        return false;
    }

    $message  = $timestamp . '.' . $rawBody;
    $expected = 'sha256=' . hash_hmac('sha256', $message, $secret);

    // hash_equals is constant-time.
    return hash_equals($expected, $signature);
}

from fastapi import Request, HTTPException

@app.post("/webhook")
async def receive_webhook(request: Request):
    raw_body = await request.body()
    headers  = dict(request.headers)

    if not verify_enclave_webhook(SIGNING_SECRET, headers, raw_body):
        raise HTTPException(status_code=401, detail="Invalid signature")

    event = await request.json()
    print(f"Received {event['type']} for tenant {event['tenant_id']}")
    return {"ok": True}

import express from "express";

app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  // express.raw() gives you a Buffer — do NOT use express.json() here
  if (!verifyEnclaveWebhook(process.env.ENCLAVE_SECRET!, req.headers as any, req.body)) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  const event = JSON.parse(req.body.toString());
  console.log(`Received ${event.type} for tenant ${event.tenant_id}`);
  res.status(200).json({ ok: true });
});

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    rawBody, err := io.ReadAll(r.Body)
    if err != nil || !verifyEnclaveWebhook(signingSecret, r, rawBody) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }

    var event map[string]any
    if err := json.Unmarshal(rawBody, &event); err != nil {
        http.Error(w, "Bad JSON", http.StatusBadRequest)
        return
    }

    fmt.Printf("Received %s\n", event["type"])
    w.WriteHeader(http.StatusOK)
}