Webhooks

{"operation":"BENEFICIARY_KYC","resourceId":"27412213-a551-48f8-a9d6-61eab2f2bd6c","createdAt":[2024,3,15,19,23,59,401139000],"integratorId":"65f0a48a79ae4e2dd70e72e2","beneficiaryId":"65f0a49179ae4e2dd70e72e4","message":null,"success":null,"data":{"id":"d356b30e-dae5-49c7-b776-d28589fc6b92","simulationId":"8a80fa558e33f7c7018e3403f9600000","integratorId":"65f0a48a79ae4e2dd70e72e2","beneficiaryId":"65f0a49179ae4e2dd70e72e4","from":{"currencyCode":"BRL","value":402.9},"to":{"currencyCode":"USDC","value":79.29},"type":"ON_RAMP","status":"SUCCEEDED","marketExchangeRate":4.9603,"exchangeRate":4.9603,"fees":{"currencyCode":"BRL","value":8.058},"finalTransactionHash":null,"effectiveTransactionValue":5.0808}}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;
import org.apache.commons.io.IOUtils;
import java.io.IOException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;

public class WebhookSignatureVerifier {

    /**
     * Verifies a HMAC SHA-256 signature for a given payload using a secret key.
     * This method compares the received signature with a freshly computed one to validate webhook data integrity and authenticity.
     *
     * @param payload           The payload for which the signature was generated, the body of the webhook request.
     * @param receivedSignature The signature received in the webhook request, usually found in a request header.
     * @param secret            The secret key provided by us for each integrator - the same used to generate the signature.
     * @return true if the received signature matches the computed signature, false otherwise.
     * @throws NoSuchAlgorithmException If the SHA-256 hashing algorithm is not available.
     * @throws InvalidKeyException      If the given secret key is invalid.
     */
    public boolean verifySignature(HttpServletRequest httpRequest, String secret) throws IOException, NoSuchAlgorithmException, InvalidKeyException {
        String payload = IOUtils.toString(httpRequest.getReader());
        String receivedSignature = httpRequest.getHeader("X-Caliza-Webhook-Signature");

        Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKey = new SecretKeySpec(secret.getBytes(), "HmacSHA256");
        sha256_HMAC.init(secretKey);

        byte[] hash = sha256_HMAC.doFinal(payload.getBytes());
        String calculatedSignature = Base64.getEncoder().encodeToString(hash);

        return MessageDigest.isEqual(calculatedSignature.getBytes(), receivedSignature.getBytes());
    }
}

const http = require('http');
const crypto = require('crypto')

const secret = "my_webhook_secret";


//Extract the raw body
const server = http.createServer((req, res) => {
    const { headers, method, url } = req;
    if (req.url === '/your-endpoint' && req.method === 'POST') {
        // Listen for data events to collect the chunks of data.
        req.on('data', chunk => {
            //Get the raw body
            req.rawBody = chunk.toString();
        });

        req.on('end', () => {
            // verify signature
            var result = verifySignature(req, secret);
            // build http response
            res.statusCode = 200;
            res.setHeader('Content-Type', 'application/json');
            const responseBody = { headers, method, url, result };
            res.write(JSON.stringify(responseBody));
            res.end();
        });

    } else {
        res.writeHead(404);
        res.end();
    }
});;

/**
 * Validates the integrity of a webhook request by comparing the received signature with a calculated signature.
 * The function extracts the signature from the 'x-caliza-webhook-signature' HTTP header of the incoming request,
 * then generates a new signature using the request's raw body and a secret key. It uses the HMAC (Hash-Based Message Authentication Code)
 * algorithm with SHA-256 as the hash function to compute the signature. The calculated signature is then compared
 * to the received signature to verify the request's integrity. This method is essential for ensuring that the webhook
 * request is from a trusted source and has not been tampered with during transmission.
 */
function verifySignature(request, secret) {
    //Extract Signature header
    let receivedSignature = request.headers['x-caliza-webhook-signature'];
    let hmac = crypto.createHmac('sha256', secret);
    hmac.update(request.rawBody);
    let calculatedSignature = hmac.digest('base64');

    return calculatedSignature === receivedSignature;
}

server.listen(3000, () => {
    console.log('Server running on http://localhost:3000');
});

const express = require('express');
const bodyParser = require("body-parser");
const crypto = require("crypto");

const app = express();

const secret = "my_webhook_secret";

//Extract the raw body
app.use(
    bodyParser.json({
      verify: (req, res, buf, encoding) => {
        if (buf && buf.length) {
          req.rawBody = buf.toString(encoding || "utf8");
        }
      },
    }),
);

app.post('/your-endpoint', (req, res) => {
  var result = verifySignature(req, secret);
  res.send(result);
});

/**
 * Validates the integrity of a webhook request by comparing the received signature with a calculated signature.
 * The function extracts the signature from the 'x-caliza-webhook-signature' HTTP header of the incoming request,
 * then generates a new signature using the request's raw body and a secret key. It uses the HMAC (Hash-Based Message Authentication Code)
 * algorithm with SHA-256 as the hash function to compute the signature. The calculated signature is then compared
 * to the received signature to verify the request's integrity. This method is essential for ensuring that the webhook
 * request is from a trusted source and has not been tampered with during transmission.
 */
function verifySignature(request, secret) {
  //Extract Signature header
  let receivedSignature = request.headers['x-caliza-webhook-signature'];
  let hmac = crypto.createHmac('sha256', secret);
  hmac.update(request.rawBody);
  let calculatedSignature = hmac.digest('base64');

  return calculatedSignature === receivedSignature;
}

app.listen(3001, () => {
  console.log('Server running on http://localhost:3000');
});

module.exports = app;