Webhooks

import crypto from 'node:crypto';

// `rawBody` MUST be the exact bytes received. In Express, capture it with
// express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).
function verifyIonhourSignature(rawBody, signatureHeader, secret) {
  if (!signatureHeader) return false;
  const expected = `sha256=${crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex')}`;
  const a = Buffer.from(signatureHeader);
  const b = Buffer.from(expected);
  // timingSafeEqual throws on length mismatch — guard first.
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post('/ionhour/webhook', (req, res) => {
  const ok = verifyIonhourSignature(
    req.rawBody,
    req.get('X-IonHour-Signature'),
    process.env.IONHOUR_WEBHOOK_SECRET,
  );
  if (!ok) return res.status(401).send('bad signature');

  const payload = JSON.parse(req.rawBody.toString('utf8'));
  // handle payload.event …
  res.sendStatus(200);
});

import hashlib
import hmac
import os

def verify_ionhour_signature(raw_body: bytes, signature_header: str, secret: str) -> bool:
    if not signature_header:
        return False
    expected = "sha256=" + hmac.new(
        secret.encode("utf-8"), raw_body, hashlib.sha256
    ).hexdigest()
    # compare_digest is constant-time and length-safe.
    return hmac.compare_digest(signature_header, expected)


# Flask example — request.get_data() returns the exact raw bytes.
@app.post("/ionhour/webhook")
def ionhour_webhook():
    if not verify_ionhour_signature(
        request.get_data(),
        request.headers.get("X-IonHour-Signature", ""),
        os.environ["IONHOUR_WEBHOOK_SECRET"],
    ):
        return "bad signature", 401

    payload = request.get_json()
    # handle payload["event"] …
    return "", 200