Webhook

<?php

function verifyOnlinefoglalasSignature(string $header, string $body, string $secret, int $tolerance = 300): bool
{
    $timestamp = null;
    $signature = null;

    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', trim($part), 2), 2, null);

        if ($key === 't') {
            $timestamp = $value;
        }

        if ($key === 'v1') {
            $signature = $value;
        }
    }

    if ($timestamp === null || $signature === null || ! ctype_digit($timestamp)) {
        return false;
    }

    $expected = hash_hmac('sha256', $timestamp . '.' . $body, $secret);

    if (! hash_equals($expected, $signature)) {
        return false;
    }

    return abs(time() - (int) $timestamp) <= $tolerance;
}

$header = $_SERVER['HTTP_X_ONLINEFOGLALAS_SIGNATURE'] ?? '';
$body = file_get_contents('php://input');

if (! verifyOnlinefoglalasSignature($header, $body, getenv('ONLINEFOGLALAS_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit;
}

$data = json_decode($body, true);

import crypto from "node:crypto";
import express from "express";

function verifyOnlinefoglalasSignature(header, rawBody, secret, toleranceSeconds = 300) {
    const parts = Object.fromEntries(
        header.split(",").map((part) => {
            const [key, ...rest] = part.trim().split("=");
            return [key, rest.join("=")];
        }),
    );

    const timestamp = parts.t;
    const signature = parts.v1;

    if (!timestamp || !signature || !/^\d+$/.test(timestamp)) {
        return false;
    }

    const expected = crypto
        .createHmac("sha256", secret)
        .update(`${timestamp}.${rawBody}`)
        .digest("hex");

    const a = Buffer.from(expected, "utf8");
    const b = Buffer.from(signature, "utf8");

    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
        return false;
    }

    return Math.abs(Date.now() / 1000 - Number(timestamp)) <= toleranceSeconds;
}

const app = express();

app.post("/webhooks/onlinefoglalas", express.raw({ type: "*/*" }), (req, res) => {
    const rawBody = req.body.toString("utf8");
    const header = req.get("X-Onlinefoglalas-Signature") ?? "";

    if (!verifyOnlinefoglalasSignature(header, rawBody, process.env.ONLINEFOGLALAS_WEBHOOK_SECRET)) {
        return res.sendStatus(400);
    }

    const data = JSON.parse(rawBody);
    res.sendStatus(204);
});

import hashlib
import hmac
import os
import time

from flask import Flask, abort, request


def verify_onlinefoglalas_signature(header: str, raw_body: bytes, secret: str, tolerance: int = 300) -> bool:
    parts = dict(part.strip().split("=", 1) for part in header.split(",") if "=" in part)
    timestamp = parts.get("t")
    signature = parts.get("v1")

    if not timestamp or not signature or not timestamp.isdigit():
        return False

    expected = hmac.new(
        secret.encode("utf-8"),
        timestamp.encode("utf-8") + b"." + raw_body,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        return False

    return abs(time.time() - int(timestamp)) <= tolerance


app = Flask(__name__)


@app.post("/webhooks/onlinefoglalas")
def onlinefoglalas_webhook():
    header = request.headers.get("X-Onlinefoglalas-Signature", "")

    if not verify_onlinefoglalas_signature(header, request.get_data(), os.environ["ONLINEFOGLALAS_WEBHOOK_SECRET"]):
        abort(400)

    data = request.get_json()
    return "", 204

require "openssl"

def verify_onlinefoglalas_signature(header, raw_body, secret, tolerance = 300)
  parts = header.to_s.split(",").map { |part| part.strip.split("=", 2) }.select { |pair| pair.size == 2 }.to_h
  timestamp = parts["t"]
  signature = parts["v1"]

  return false if timestamp.nil? || signature.nil? || timestamp !~ /\A\d+\z/

  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}.#{raw_body}")

  return false unless Rack::Utils.secure_compare(expected, signature)

  (Time.now.to_i - timestamp.to_i).abs <= tolerance
end

# Rails controllerben
def onlinefoglalas_webhook
  valid = verify_onlinefoglalas_signature(
    request.headers["X-Onlinefoglalas-Signature"],
    request.raw_post,
    ENV.fetch("ONLINEFOGLALAS_WEBHOOK_SECRET"),
  )

  return head :bad_request unless valid

  data = JSON.parse(request.raw_post)
  head :no_content
end

package webhook

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"math"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

func VerifyOnlinefoglalasSignature(header string, rawBody []byte, secret string, tolerance time.Duration) bool {
	var timestamp, signature string

	for _, part := range strings.Split(header, ",") {
		key, value, found := strings.Cut(strings.TrimSpace(part), "=")
		if !found {
			continue
		}

		switch key {
		case "t":
			timestamp = value
		case "v1":
			signature = value
		}
	}

	if timestamp == "" || signature == "" {
		return false
	}

	ts, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil {
		return false
	}

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(timestamp + "."))
	mac.Write(rawBody)
	expected := hex.EncodeToString(mac.Sum(nil))

	if !hmac.Equal([]byte(expected), []byte(signature)) {
		return false
	}

	return math.Abs(time.Since(time.Unix(ts, 0)).Seconds()) <= tolerance.Seconds()
}

func Handler(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(r.Body)
	if err != nil {
		w.WriteHeader(http.StatusBadRequest)
		return
	}

	header := r.Header.Get("X-Onlinefoglalas-Signature")
	if !VerifyOnlinefoglalasSignature(header, body, os.Getenv("ONLINEFOGLALAS_WEBHOOK_SECRET"), 5*time.Minute) {
		w.WriteHeader(http.StatusBadRequest)
		return
	}

	w.WriteHeader(http.StatusNoContent)
}