Webhooks

import hmac
import hashlib
import os
from flask import Flask, request, abort

app = Flask(__name__)
SIGNING_SECRET = os.environ["PROPSOCKET_SIGNING_SECRET"].encode("utf-8")


def verify_signature(raw_body: bytes, header_signature: str, secret: bytes) -> bool:
    if not header_signature:
        return False
    expected = hmac.new(secret, raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header_signature)


@app.post("/webhooks/propsocket")
def receive_webhook():
    raw_body = request.get_data()  # bytes, untouched
    signature = request.headers.get("X-PropSocket-Signature", "")
    if not verify_signature(raw_body, signature, SIGNING_SECRET):
        abort(401)
    event = request.get_json()
    enqueue_for_processing(event)  # acknowledge fast, process async
    return ("ok", 200)

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"net/http"
	"os"
)

var signingSecret = []byte(os.Getenv("PROPSOCKET_SIGNING_SECRET"))

func verifySignature(rawBody []byte, headerSignature string, secret []byte) bool {
	if headerSignature == "" {
		return false
	}
	mac := hmac.New(sha256.New, secret)
	mac.Write(rawBody)
	expected := mac.Sum(nil)

	received, err := hex.DecodeString(headerSignature)
	if err != nil {
		return false
	}
	// hmac.Equal is constant-time and length-safe.
	return hmac.Equal(expected, received)
}

func receiveWebhook(w http.ResponseWriter, r *http.Request) {
	rawBody, err := io.ReadAll(r.Body) // exact bytes, untouched
	if err != nil {
		http.Error(w, "bad request", http.StatusBadRequest)
		return
	}
	sig := r.Header.Get("X-PropSocket-Signature")
	if !verifySignature(rawBody, sig, signingSecret) {
		http.Error(w, "invalid signature", http.StatusUnauthorized)
		return
	}
	enqueueForProcessing(rawBody) // acknowledge fast, process async
	w.WriteHeader(http.StatusOK)
	_, _ = w.Write([]byte("ok"))
}

require "openssl"
require "sinatra"

SIGNING_SECRET = ENV.fetch("PROPSOCKET_SIGNING_SECRET")

def verify_signature(raw_body, header_signature, secret)
  return false if header_signature.nil? || header_signature.empty?

  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, raw_body)
  # secure_compare is constant-time and length-safe.
  Rack::Utils.secure_compare(expected, header_signature)
end

post "/webhooks/propsocket" do
  request.body.rewind
  raw_body = request.body.read # exact bytes, untouched
  signature = request.env["HTTP_X_PROPSOCKET_SIGNATURE"].to_s

  halt 401, "invalid signature" unless verify_signature(raw_body, signature, SIGNING_SECRET)

  event = JSON.parse(raw_body)
  enqueue_for_processing(event) # acknowledge fast, process async
  status 200
  "ok"
end

<?php
// Plain PHP — read the raw body from php://input before any framework parses it.
$signingSecret = getenv("PROPSOCKET_SIGNING_SECRET");

function verify_signature(string $rawBody, ?string $headerSignature, string $secret): bool
{
    if (empty($headerSignature)) {
        return false;
    }
    $expected = hash_hmac("sha256", $rawBody, $secret);
    return hash_equals($expected, $headerSignature); // constant-time, length-safe
}

$rawBody = file_get_contents("php://input"); // exact bytes, untouched
$signature = $_SERVER["HTTP_X_PROPSOCKET_SIGNATURE"] ?? "";

if (!verify_signature($rawBody, $signature, $signingSecret)) {
    http_response_code(401);
    echo "invalid signature";
    exit;
}

$event = json_decode($rawBody, true);
enqueue_for_processing($event); // acknowledge fast, process async
http_response_code(200);
echo "ok";

import static spark.Spark.*;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import java.util.HexFormat;

public class Webhook {
  static final byte[] SECRET =
      System.getenv("PROPSOCKET_SIGNING_SECRET").getBytes();

  static boolean verifySignature(byte[] rawBody, String headerSignature, byte[] secret)
      throws Exception {
    if (headerSignature == null || headerSignature.isEmpty()) return false;
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret, "HmacSHA256"));
    String expected = HexFormat.of().formatHex(mac.doFinal(rawBody));
    return MessageDigest.isEqual(expected.getBytes(), headerSignature.getBytes());
  }

  public static void main(String[] args) {
    post("/webhooks/propsocket", (req, res) -> {
      byte[] rawBody = req.bodyAsBytes(); // exact bytes, untouched
      String sig = req.headers("X-PropSocket-Signature");
      if (!verifySignature(rawBody, sig, SECRET)) {
        res.status(401);
        return "invalid signature";
      }
      enqueueForProcessing(rawBody); // acknowledge fast, process async
      res.status(200);
      return "ok";
    });
  }
}

using System.Security.Cryptography;
using System.Text;

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();
var secret = Encoding.UTF8.GetBytes(
    Environment.GetEnvironmentVariable("PROPSOCKET_SIGNING_SECRET")!);

static bool VerifySignature(byte[] rawBody, string? headerSignature, byte[] secret)
{
    if (string.IsNullOrEmpty(headerSignature)) return false;
    using var hmac = new HMACSHA256(secret);
    var expected = Convert.ToHexString(hmac.ComputeHash(rawBody)).ToLowerInvariant();
    return CryptographicOperations.FixedTimeEquals(
        Encoding.UTF8.GetBytes(expected), Encoding.UTF8.GetBytes(headerSignature));
}

app.MapPost("/webhooks/propsocket", async (HttpRequest req) =>
{
    using var ms = new MemoryStream();
    await req.Body.CopyToAsync(ms);
    var rawBody = ms.ToArray(); // exact bytes, untouched
    var sig = req.Headers["X-PropSocket-Signature"].ToString();
    if (!VerifySignature(rawBody, sig, secret))
        return Results.Text("invalid signature", statusCode: 401);

    EnqueueForProcessing(rawBody); // acknowledge fast, process async
    return Results.Text("ok");
});

app.Run();

// Idempotency: dedupe on the event id (a ULID, prefixed evt_).
// At-least-once delivery means duplicates are expected, not exceptional.
import { createClient } from 'redis';
const redis = createClient({ url: process.env.REDIS_URL });
await redis.connect();

async function alreadyProcessed(eventId) {
  // SET NX returns null when the key already exists.
  // 7-day TTL comfortably outlasts the ~7h36m retry window.
  const set = await redis.set(`webhook:seen:${eventId}`, '1', {
    NX: true,
    EX: 7 * 24 * 3600,
  });
  return set === null;
}

// in your handler, after signature verification:
const event = JSON.parse(rawBody);
if (await alreadyProcessed(event.id)) {
  return res.status(200).send('ok'); // ack and drop; already handled
}
process(event);

// Idempotency: dedupe on the event id (a ULID, prefixed evt_).
// At-least-once delivery means duplicates are expected, not exceptional.
import (
	"context"
	"time"

	"github.com/redis/go-redis/v9"
)

var rdb = redis.NewClient(&redis.Options{Addr: "localhost:6379"})

func alreadyProcessed(ctx context.Context, eventID string) bool {
	// SetNX returns false (won=false) when the key already exists.
	// 7-day TTL comfortably outlasts the ~7h36m retry window.
	won, _ := rdb.SetNX(ctx, "webhook:seen:"+eventID, "1", 7*24*time.Hour).Result()
	return !won
}

// in your handler, after signature verification:
//   if alreadyProcessed(ctx, event.ID) { return /* ack 200 and drop */ }
//   process(event)

# Idempotency: dedupe on the event id (a ULID, prefixed evt_).
# At-least-once delivery means duplicates are expected, not exceptional.
require "redis"

REDIS = Redis.new(url: ENV.fetch("REDIS_URL"))

def already_processed?(event_id)
  # SET NX returns false when the key already exists.
  # 7-day TTL comfortably outlasts the ~7h36m retry window.
  !REDIS.set("webhook:seen:#{event_id}", "1", nx: true, ex: 7 * 24 * 3600)
end

# in your handler, after signature verification:
event = JSON.parse(raw_body)
return [200, {}, ["ok"]] if already_processed?(event["id"]) # ack and drop
process(event)

<?php
// Idempotency: dedupe on the event id (a ULID, prefixed evt_).
// At-least-once delivery means duplicates are expected, not exceptional.
$redis = new Redis();
$redis->connect("127.0.0.1", 6379);

function already_processed(Redis $redis, string $eventId): bool
{
    // SET with NX returns false when the key already exists.
    // 7-day TTL comfortably outlasts the ~7h36m retry window.
    return !$redis->set("webhook:seen:$eventId", "1", ["nx", "ex" => 7 * 24 * 3600]);
}

// in your handler, after signature verification:
$event = json_decode($rawBody, true);
if (already_processed($redis, $event["id"])) {
    http_response_code(200);
    echo "ok"; // ack and drop; already handled
    exit;
}
process($event);

// Idempotency: dedupe on the event id (a ULID, prefixed evt_).
// At-least-once delivery means duplicates are expected, not exceptional.
import redis.clients.jedis.JedisPooled;
import redis.clients.jedis.params.SetParams;

JedisPooled jedis = new JedisPooled(System.getenv("REDIS_URL"));

boolean alreadyProcessed(String eventId) {
    // SET NX returns null when the key already exists.
    // 7-day TTL comfortably outlasts the ~7h36m retry window.
    String set = jedis.set("webhook:seen:" + eventId, "1",
            new SetParams().nx().ex(7 * 24 * 3600));
    return set == null;
}

// in your handler, after signature verification:
//   if (alreadyProcessed(event.get("id").asText())) return; // ack 200 and drop
//   process(event);

// Idempotency: dedupe on the event id (a ULID, prefixed evt_).
// At-least-once delivery means duplicates are expected, not exceptional.
using StackExchange.Redis;

var redis = await ConnectionMultiplexer.ConnectAsync(
    Environment.GetEnvironmentVariable("REDIS_URL")!);
var db = redis.GetDatabase();

async Task<bool> AlreadyProcessed(string eventId)
{
    // StringSet with When.NotExists returns false when the key already exists.
    // 7-day TTL comfortably outlasts the ~7h36m retry window.
    bool won = await db.StringSetAsync(
        $"webhook:seen:{eventId}", "1",
        TimeSpan.FromDays(7), When.NotExists);
    return !won;
}

// in your handler, after signature verification:
//   if (await AlreadyProcessed(eventId)) return Results.Text("ok"); // ack and drop
//   await Process(evt);