Webhooks & Events

import crypto from 'crypto';
 
interface VerificationResult {
  valid: boolean;
  error?: string;
}
 
function verifyWebhookSignature(
  payload: string,
  signature: string | null,
  timestamp: string | null,
  secret: string
): VerificationResult {
  // Signatur und Timestamp prüfen
  if (!signature || !timestamp) {
    return { valid: false, error: 'Fehlende Signatur oder Timestamp' };
  }
 
  // Timestamp-Freshness prüfen (max 5 Minuten)
  const timestampMs = parseInt(timestamp, 10) * 1000;
  const now = Date.now();
  const fiveMinutes = 5 * 60 * 1000;
 
  if (Math.abs(now - timestampMs) > fiveMinutes) {
    return { valid: false, error: 'Timestamp zu alt (Replay-Angriff?)' };
  }
 
  // Erwartete Signatur berechnen
  const signedPayload = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');
 
  // Timing-sicherer Vergleich
  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
 
  return { valid: isValid };
}
 
// Verwendung in Ihrem Webhook-Handler
export async function POST(request: Request) {
  const payload = await request.text();
  const signature = request.headers.get('x-bg-signature');
  const timestamp = request.headers.get('x-bg-timestamp');
 
  const verification = verifyWebhookSignature(
    payload,
    signature,
    timestamp,
    process.env.BUCHHALTGENIE_WEBHOOK_SECRET!
  );
 
  if (!verification.valid) {
    console.error('Webhook-Validierung fehlgeschlagen:', verification.error);
    return new Response('Ungültige Signatur', { status: 401 });
  }
 
  // Webhook verarbeiten...
  const event = JSON.parse(payload);
  // ...
}

import hmac
import hashlib
import time
from typing import Tuple
 
def verify_webhook_signature(
    payload: str,
    signature: str,
    timestamp: str,
    secret: str
) -> Tuple[bool, str]:
    """
    Validiert die Webhook-Signatur von BuchhaltGenie.
 
    Returns:
        Tuple[bool, str]: (ist_valide, fehlermeldung)
    """
    if not signature or not timestamp:
        return False, "Fehlende Signatur oder Timestamp"
 
    # Timestamp-Freshness prüfen (max 5 Minuten)
    timestamp_int = int(timestamp)
    now = int(time.time())
    five_minutes = 5 * 60
 
    if abs(now - timestamp_int) > five_minutes:
        return False, "Timestamp zu alt (Replay-Angriff?)"
 
    # Erwartete Signatur berechnen
    signed_payload = f"{timestamp}.{payload}"
    expected_signature = hmac.new(
        secret.encode('utf-8'),
        signed_payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
 
    # Timing-sicherer Vergleich
    is_valid = hmac.compare_digest(signature, expected_signature)
 
    return is_valid, "" if is_valid else "Ungültige Signatur"
 
 
# Verwendung in Flask
from flask import Flask, request, jsonify
 
app = Flask(__name__)
 
@app.route('/webhook', methods=['POST'])
def handle_webhook():
    payload = request.get_data(as_text=True)
    signature = request.headers.get('X-Bg-Signature')
    timestamp = request.headers.get('X-Bg-Timestamp')
 
    is_valid, error = verify_webhook_signature(
        payload,
        signature,
        timestamp,
        os.environ['BUCHHALTGENIE_WEBHOOK_SECRET']
    )
 
    if not is_valid:
        return jsonify({'error': error}), 401
 
    event = request.get_json()
    # Event verarbeiten...
 
    return jsonify({'received': True}), 200

<?php
 
function verifyWebhookSignature(
    string $payload,
    ?string $signature,
    ?string $timestamp,
    string $secret
): array {
    if (!$signature || !$timestamp) {
        return ['valid' => false, 'error' => 'Fehlende Signatur oder Timestamp'];
    }
 
    // Timestamp-Freshness prüfen (max 5 Minuten)
    $timestampInt = (int) $timestamp;
    $now = time();
    $fiveMinutes = 5 * 60;
 
    if (abs($now - $timestampInt) > $fiveMinutes) {
        return ['valid' => false, 'error' => 'Timestamp zu alt (Replay-Angriff?)'];
    }
 
    // Erwartete Signatur berechnen
    $signedPayload = $timestamp . '.' . $payload;
    $expectedSignature = hash_hmac('sha256', $signedPayload, $secret);
 
    // Timing-sicherer Vergleich
    $isValid = hash_equals($expectedSignature, $signature);
 
    return ['valid' => $isValid, 'error' => $isValid ? null : 'Ungültige Signatur'];
}
 
// Verwendung
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_BG_SIGNATURE'] ?? null;
$timestamp = $_SERVER['HTTP_X_BG_TIMESTAMP'] ?? null;
$secret = getenv('BUCHHALTGENIE_WEBHOOK_SECRET');
 
$result = verifyWebhookSignature($payload, $signature, $timestamp, $secret);
 
if (!$result['valid']) {
    http_response_code(401);
    echo json_encode(['error' => $result['error']]);
    exit;
}
 
$event = json_decode($payload, true);
// Event verarbeiten...
 
http_response_code(200);
echo json_encode(['received' => true]);