Verifikasi signature

Jika webhook punya HMAC key, setiap request membawa header:

X-Kirimwa-Signature: sha256=<hex>

<hex> adalah HMAC-SHA256 dari body mentah request dengan HMAC key sebagai kuncinya. Hitung ulang di server Anda, lalu bandingkan.

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

const app = express();

app.post('/webhook/nusawap', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = 'sha256=' +
    createHmac('sha256', process.env.NUSAWAP_HMAC_KEY).update(req.body).digest('hex');
  const given = req.get('X-Kirimwa-Signature') ?? '';

  const ok = given.length === expected.length &&
    timingSafeEqual(Buffer.from(given), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body);
  res.sendStatus(200);
  // proses event di sini…
});

import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhook/nusawap")
def webhook():
    key = os.environ["NUSAWAP_HMAC_KEY"].encode()
    expected = "sha256=" + hmac.new(key, request.get_data(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-Kirimwa-Signature", "")):
        abort(401)
    event = request.get_json()
    return "", 200

$body = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $body, getenv('NUSAWAP_HMAC_KEY'));
$given = $_SERVER['HTTP_X_KIRIMWA_SIGNATURE'] ?? '';

if (!hash_equals($expected, $given)) {
    http_response_code(401);
    exit;
}
$event = json_decode($body, true);
http_response_code(200);