Assinatura & Segurança

import crypto from 'crypto';
import express from 'express';

const app = express();

// IMPORTANTE: use express.raw() na rota do webhook, não express.json()
app.post('/webhook/cordialy', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-cordialy-signature'] as string;
  const secret = process.env.CORDIALY_WEBHOOK_SECRET!;

  if (!validarAssinatura(req.body, signature, secret)) {
    return res.status(401).send('Assinatura inválida');
  }

  const evento = JSON.parse(req.body.toString());
  // processar evento...

  res.status(200).send('ok');
});

function validarAssinatura(rawBody: Buffer, signature: string, secret: string): boolean {
  const esperado = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(esperado)
  );
}

import hmac
import hashlib
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.post('/webhook/cordialy')
async def receber_webhook(request: Request):
    # IMPORTANTE: leia o body bruto ANTES de qualquer parsing
    raw_body = await request.body()
    signature = request.headers.get('x-cordialy-signature', '')
    secret = os.environ['CORDIALY_WEBHOOK_SECRET']

    if not validar_assinatura(raw_body, signature, secret):
        raise HTTPException(status_code=401, detail='Assinatura inválida')

    evento = json.loads(raw_body)
    # processar evento...

    return {'ok': True}

def validar_assinatura(raw_body: bytes, signature: str, secret: str) -> bool:
    esperado = 'sha256=' + hmac.new(
        secret.encode('utf-8'),
        raw_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, esperado)

<?php
// IMPORTANTE: use getContent(), não $request->input() nem $_POST
function handleWebhook(Request $request) {
    $rawBody = $request->getContent();
    $signature = $request->header('X-Cordialy-Signature');
    $secret = env('CORDIALY_WEBHOOK_SECRET');

    if (!validarAssinatura($rawBody, $signature, $secret)) {
        return response('Assinatura inválida', 401);
    }

    $evento = json_decode($rawBody, true);
    // processar evento...

    return response('ok', 200);
}

function validarAssinatura(string $rawBody, string $signature, string $secret): bool {
    $esperado = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);
    return hash_equals($esperado, $signature);
}