웹훅 개요

import crypto from "node:crypto";
import express from "express";

const app = express();

// 원본 바이트가 필요해요. Content-Type 헤더가 없어도 받도록 모든 타입을 허용해요.
app.post("/paysync/webhook", express.raw({ type: () => true }), (req, res) => {
  const id = req.header("webhook-id");
  const timestamp = req.header("webhook-timestamp");
  const signatureHeader = req.header("webhook-signature");
  if (!id || !timestamp || !signatureHeader) return res.sendStatus(401);

  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(401).send("expired");
  }

  const body = req.body.toString("utf8");
  const key = Buffer.from(process.env.PAYSYNC_WEBHOOK_SECRET.replace(/^whsec_/, ""), "base64");
  const expected = crypto.createHmac("sha256", key).update(`${id}.${timestamp}.${body}`).digest();
  const provided = Buffer.from(signatureHeader.split(",")[1] ?? "", "base64");

  if (provided.length !== expected.length || !crypto.timingSafeEqual(provided, expected)) {
    return res.status(401).send("invalid signature");
  }

  const event = JSON.parse(body);
  switch (event.type) {
    case "invoice.paid":
      break;
    case "invoice.expired":
      break;
    case "transaction.created":
      break;
    default:
      break; // 모르는 이벤트는 무시해요.
  }

  res.sendStatus(200);
});

import base64
import hashlib
import hmac
import json
import os
import time

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["PAYSYNC_WEBHOOK_SECRET"]  # whsec_...


@app.post("/paysync/webhook")
def paysync_webhook():
    webhook_id = request.headers.get("webhook-id")
    timestamp = request.headers.get("webhook-timestamp")
    signature_header = request.headers.get("webhook-signature")
    if not (webhook_id and timestamp and signature_header):
        abort(401)

    if abs(time.time() - int(timestamp)) > 300:
        abort(401, "expired")

    body = request.get_data(as_text=True)
    key = base64.b64decode(SECRET.removeprefix("whsec_"))
    expected = base64.b64encode(
        hmac.new(key, f"{webhook_id}.{timestamp}.{body}".encode(), hashlib.sha256).digest()
    ).decode()
    provided = signature_header.split(",", 1)[1] if "," in signature_header else ""

    if not hmac.compare_digest(expected, provided):
        abort(401, "invalid signature")

    event = json.loads(body)
    # event["type"]으로 나눠 처리해요.
    return "", 200

import io.ktor.http.*
import io.ktor.server.application.*
import io.ktor.server.request.*
import io.ktor.server.response.*
import io.ktor.server.routing.*
import java.security.MessageDigest
import java.util.Base64
import javax.crypto.Mac
import javax.crypto.spec.SecretKeySpec
import kotlin.math.abs

fun Application.paysyncWebhook() {
    val secret = System.getenv("PAYSYNC_WEBHOOK_SECRET") // whsec_...

    routing {
        post("/paysync/webhook") {
            val id = call.request.header("webhook-id")
            val timestamp = call.request.header("webhook-timestamp")
            val signatureHeader = call.request.header("webhook-signature")
            if (id == null || timestamp == null || signatureHeader == null) {
                return@post call.respond(HttpStatusCode.Unauthorized)
            }

            if (abs(System.currentTimeMillis() / 1000 - timestamp.toLong()) > 300) {
                return@post call.respond(HttpStatusCode.Unauthorized, "expired")
            }

            val body = call.receiveText()
            val key = Base64.getDecoder().decode(secret.removePrefix("whsec_"))
            val mac = Mac.getInstance("HmacSHA256").apply { init(SecretKeySpec(key, "HmacSHA256")) }
            val expected = Base64.getEncoder().encodeToString(mac.doFinal("$id.$timestamp.$body".toByteArray()))
            val provided = signatureHeader.substringAfter(",", "")

            if (!MessageDigest.isEqual(expected.toByteArray(), provided.toByteArray())) {
                return@post call.respond(HttpStatusCode.Unauthorized, "invalid signature")
            }

            // body의 type으로 나눠 처리해요.
            call.respond(HttpStatusCode.OK)
        }
    }
}

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Base64;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class PaySyncWebhookController {

    private static final String SECRET = System.getenv("PAYSYNC_WEBHOOK_SECRET"); // whsec_...

    @PostMapping("/paysync/webhook")
    public ResponseEntity<String> receive(
            @RequestHeader("webhook-id") String id,
            @RequestHeader("webhook-timestamp") String timestamp,
            @RequestHeader("webhook-signature") String signatureHeader,
            @RequestBody String body
    ) throws Exception {
        long now = System.currentTimeMillis() / 1000;
        if (Math.abs(now - Long.parseLong(timestamp)) > 300) {
            return ResponseEntity.status(401).body("expired");
        }

        byte[] key = Base64.getDecoder().decode(SECRET.replaceFirst("^whsec_", ""));
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(key, "HmacSHA256"));
        String expected = Base64.getEncoder().encodeToString(
            mac.doFinal((id + "." + timestamp + "." + body).getBytes(StandardCharsets.UTF_8))
        );
        String provided = signatureHeader.contains(",") ? signatureHeader.split(",", 2)[1] : "";

        if (!MessageDigest.isEqual(expected.getBytes(), provided.getBytes())) {
            return ResponseEntity.status(401).body("invalid signature");
        }

        // body의 type으로 나눠 처리해요.
        return ResponseEntity.ok().build();
    }
}

use axum::http::{HeaderMap, StatusCode};
use base64::{engine::general_purpose::STANDARD as B64, Engine};
use hmac::{Hmac, Mac};
use sha2::Sha256;
use std::time::{SystemTime, UNIX_EPOCH};
use subtle::ConstantTimeEq;

type HmacSha256 = Hmac<Sha256>;

async fn paysync_webhook(headers: HeaderMap, body: String) -> StatusCode {
    let header = |name: &str| headers.get(name).and_then(|v| v.to_str().ok());
    let (Some(id), Some(ts), Some(sig_header)) =
        (header("webhook-id"), header("webhook-timestamp"), header("webhook-signature"))
    else {
        return StatusCode::UNAUTHORIZED;
    };

    let now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64;
    if (now - ts.parse::<i64>().unwrap_or(0)).abs() > 300 {
        return StatusCode::UNAUTHORIZED;
    }

    let secret = std::env::var("PAYSYNC_WEBHOOK_SECRET").unwrap(); // whsec_...
    let Ok(key) = B64.decode(secret.trim_start_matches("whsec_")) else {
        return StatusCode::INTERNAL_SERVER_ERROR;
    };

    let mut mac = HmacSha256::new_from_slice(&key).unwrap();
    mac.update(format!("{id}.{ts}.{body}").as_bytes());
    let expected = B64.encode(mac.finalize().into_bytes());
    let provided = sig_header.split_once(',').map(|(_, s)| s).unwrap_or("");

    if expected.as_bytes().ct_eq(provided.as_bytes()).unwrap_u8() != 1 {
        return StatusCode::UNAUTHORIZED;
    }

    // serde_json::from_str(&body)로 파싱하고 type으로 나눠 처리해요.
    StatusCode::OK
}