Webhook: tamamlanan yazı imzalı bir istekle sisteminize gelir

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.BETIG_WEBHOOK_SECRET; // whsec_ ile başlar
const TOLERANCE = 5 * 60; // saniye

function verify(rawBody, headers) {
  const id = headers["webhook-id"];
  const ts = headers["webhook-timestamp"];
  const sigHeader = headers["webhook-signature"];
  if (!id || !ts || !sigHeader) return false;
  if (Math.abs(Date.now() / 1000 - Number(ts)) > TOLERANCE) return false;

  const key = Buffer.from(SECRET.replace(/^whsec_/, ""), "base64");
  const expected = crypto
    .createHmac("sha256", key)
    .update(`${id}.${ts}.${rawBody}`)
    .digest("base64");

  return sigHeader.split(" ").some((part) => {
    const [version, sig] = part.split(",");
    if (version !== "v1" || !sig) return false;
    const a = Buffer.from(sig);
    const b = Buffer.from(expected);
    return a.length === b.length && crypto.timingSafeEqual(a, b);
  });
}

const app = express();
// Gövdeyi ham haliyle alın; JSON'a çevirip geri yazmak imzayı bozar.
app.post("/webhooks/betig", express.raw({ type: "application/json" }), (req, res) => {
  const raw = req.body.toString("utf8");
  if (!verify(raw, req.headers)) return res.status(401).end();
  const event = JSON.parse(raw);
  // event.data.status her zaman "draft": yazıyı taslak olarak kaydedin.
  res.status(204).end();
});

<?php
function betig_verify(string $body, array $h, string $secret): bool {
    $id  = $h['HTTP_WEBHOOK_ID'] ?? '';
    $ts  = $h['HTTP_WEBHOOK_TIMESTAMP'] ?? '';
    $sig = $h['HTTP_WEBHOOK_SIGNATURE'] ?? '';
    if ($id === '' || $ts === '' || $sig === '') return false;
    if (abs(time() - (int) $ts) > 300) return false;

    $key = base64_decode(preg_replace('/^whsec_/', '', $secret));
    $expected = base64_encode(hash_hmac('sha256', "$id.$ts.$body", $key, true));

    foreach (explode(' ', $sig) as $part) {
        [$version, $value] = array_pad(explode(',', $part, 2), 2, '');
        if ($version === 'v1' && hash_equals($expected, $value)) return true;
    }
    return false;
}

$body = file_get_contents('php://input');
if (!betig_verify($body, $_SERVER, getenv('BETIG_WEBHOOK_SECRET'))) {
    http_response_code(401);
    exit;
}
$event = json_decode($body, true);
http_response_code(204);

import base64, hashlib, hmac, os, time

SECRET = os.environ["BETIG_WEBHOOK_SECRET"]  # whsec_ ile başlar

def verify(body: bytes, headers) -> bool:
    msg_id = headers.get("webhook-id", "")
    ts = headers.get("webhook-timestamp", "")
    sig_header = headers.get("webhook-signature", "")
    if not (msg_id and ts and sig_header):
        return False
    if abs(time.time() - int(ts)) > 300:
        return False
    key = base64.b64decode(SECRET.removeprefix("whsec_"))
    signed = f"{msg_id}.{ts}.".encode() + body
    expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest()).decode()
    for part in sig_header.split():
        version, _, sig = part.partition(",")
        if version == "v1" and hmac.compare_digest(sig, expected):
            return True
    return False