Webhooks

const { createPublicKey, verify } = require('crypto');

function verifyWebhook(req) {
  const signature = req.headers['x-phoenix-pay-signature'];
  const timestamp = req.headers['x-phoenix-pay-timestamp'];
  const body = req.rawBody; // Must be the raw string

  // Check timestamp freshness
  const age = Math.floor(Date.now() / 1000) - parseInt(timestamp);
  if (age > 300) throw new Error('Webhook timestamp too old');

  // Reconstruct signing input
  const signingInput = `${timestamp}.${body}`;

  // Create public key object from base64
  const publicKey = createPublicKey({
    key: Buffer.from(PUBLIC_KEY_BASE64, 'base64'),
    format: 'der',
    type: 'spki',
  });

  // Verify Ed25519 signature
  const isValid = verify(
    null,
    Buffer.from(signingInput),
    publicKey,
    Buffer.from(signature, 'base64')
  );

  if (!isValid) throw new Error('Invalid webhook signature');
  return JSON.parse(body);
}

import time
import base64
import json
from nacl.signing import VerifyKey
from nacl.exceptions import BadSignatureError

def verify_webhook(headers, body):
    signature_b64 = headers["X-Phoenix-Pay-Signature"]
    timestamp = headers["X-Phoenix-Pay-Timestamp"]

    # Check timestamp freshness
    age = int(time.time()) - int(timestamp)
    if age > 300:
        raise ValueError("Webhook timestamp too old")

    # Reconstruct signing input
    signing_input = f"{timestamp}.{body}"

    # Verify Ed25519 signature
    try:
        public_key_bytes = base64.b64decode(PUBLIC_KEY_BASE64)
        verify_key = VerifyKey(public_key_bytes)
        signature = base64.b64decode(signature_b64)
        verify_key.verify(signing_input.encode("utf-8"), signature)
    except BadSignatureError:
        raise ValueError("Invalid webhook signature")

    return json.loads(body)

defmodule MyApp.WebhookVerifier do
  @max_age_seconds 300

  def verify(headers, raw_body, public_key_base64) do
    with {:ok, signature_b64} <- get_header(headers, "x-phoenix-pay-signature"),
         {:ok, timestamp} <- get_header(headers, "x-phoenix-pay-timestamp"),
         :ok <- check_freshness(timestamp),
         :ok <- verify_signature(timestamp, raw_body, signature_b64, public_key_base64) do
      {:ok, Jason.decode!(raw_body)}
    end
  end

  defp check_freshness(timestamp) do
    age = System.os_time(:second) - String.to_integer(timestamp)
    if age > @max_age_seconds, do: {:error, :timestamp_too_old}, else: :ok
  end

  defp verify_signature(timestamp, body, signature_b64, public_key_b64) do
    signing_input = "#{timestamp}.#{body}"
    public_key = Base.decode64!(public_key_b64)
    signature = Base.decode64!(signature_b64)

    if :crypto.verify(:eddsa, :none, signing_input, signature, [public_key, :ed25519]),
      do: :ok,
      else: {:error, :invalid_signature}
  end

  defp get_header(headers, name) do
    case List.keyfind(headers, name, 0) do
      {_, value} -> {:ok, value}
      nil -> {:error, {:missing_header, name}}
    end
  end
end

package webhook

import (
	"crypto/ed25519"
	"encoding/base64"
	"errors"
	"fmt"
	"math"
	"strconv"
	"time"
)

func VerifyWebhook(
	signatureB64 string,
	timestamp string,
	body []byte,
	publicKeyB64 string,
) error {
	ts, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil {
		return errors.New("invalid timestamp")
	}
	if math.Abs(float64(time.Now().Unix()-ts)) > 300 {
		return errors.New("webhook timestamp too old")
	}

	signingInput := fmt.Sprintf("%s.%s", timestamp, string(body))
	publicKey, err := base64.StdEncoding.DecodeString(publicKeyB64)
	if err != nil {
		return errors.New("invalid public key encoding")
	}
	signature, err := base64.StdEncoding.DecodeString(signatureB64)
	if err != nil {
		return errors.New("invalid signature encoding")
	}

	if !ed25519.Verify(publicKey, []byte(signingInput), signature) {
		return errors.New("invalid webhook signature")
	}
	return nil
}