codesnips

hmac

ruby 
timestamp = request.headers.fetch('X-Signature-Timestamp')
signature = request.headers.fetch('X-Signature')
payload = request.raw_post

data = "#{timestamp}.#{payload}"
expected = OpenSSL::HMAC.hexdigest('SHA256', ENV.fetch('WEBHOOK_SECRET'), data)

HMAC signed API requests for webhook and partner integrity

hmac api-signing webhooks
by Kai Nakamura 2 tabs
ruby 
event_id = request.headers.fetch('X-Event-Id')
timestamp = request.headers.fetch('X-Signature-Timestamp').to_i

raise ActionController::BadRequest, 'stale request' if Time.now.to_i - timestamp > 300
raise ActionController::BadRequest, 'replay detected' if WebhookEvent.exists?(external_id: event_id)

Secure webhook endpoint design with replay protection

webhooks replay-protection hmac
by Kai Nakamura 1 tab
typescript 
import crypto from 'crypto';

interface VerifyOptions {
  rawBody: Buffer;
  signatureHeader: string | undefined;
  secret: string;

Webhook signature verification (timing-safe compare)

security webhooks hmac
by codesnips 3 tabs
ruby 
require 'sinatra/base'
require 'json'
require_relative 'signature_verifier'

class WebhookApp < Sinatra::Base
  configure do

Verifying Stripe Webhook Signatures in Sinatra with a before Filter

sinatra webhooks stripe
by codesnips 2 tabs
javascript 
const crypto = require('crypto');

function computeSignature(secret, timestamp, payload) {
  return crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`, 'utf8')

Verify Stripe-Style Webhook Signatures With HMAC in Express Before Processing

webhooks hmac security
by codesnips 2 tabs
go 
package session

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"

Stateless Session Cookies Signed and Verified With HMAC in Go

go security cookies
by codesnips 3 tabs
python 
import hashlib
import hmac
import time


class SignatureError(Exception):

Verify Stripe-Style Webhook HMAC Signatures Before Processing in Flask

flask webhooks hmac
by codesnips 3 tabs
typescript 
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  // rawBody: true preserves the exact bytes Stripe signed
  const app = await NestFactory.create(AppModule, { rawBody: true });

Verify Stripe Webhook Signatures in a NestJS Guard Before the Handler

nestjs webhooks stripe
by codesnips 4 tabs
ruby 
class DownloadsController < ApplicationController
  before_action :authenticate_user!, only: :create
  skip_before_action :verify_authenticity_token, only: :show

  def create
    document = current_user.documents.find(params[:document_id])

Signed, Expiring Download URLs With HMAC Verification in Rails

rails hmac security
by codesnips 3 tabs
php 
<?php

namespace App\Controller;

use App\Message\ProcessStripeEvent;
use App\Webhook\StripeSignatureVerifier;

Verifying and Processing Stripe-Style Webhooks Idempotently in Symfony

symfony webhooks stripe
by codesnips 3 tabs
ruby 
class User < ApplicationRecord
  has_secure_password

  RESET_TOKEN_TTL = 30.minutes

  def self.reset_verifier

Signed Password Reset Tokens with ActiveSupport::MessageVerifier in Rails

rails authentication password-reset
by codesnips 3 tabs
ruby 
class WebhookSignature
  class VerificationError < StandardError; end

  TOLERANCE = 300 # seconds

  def initialize(payload:, header:, secrets:)

Robust Webhook Verification (HMAC + Timestamp)

rails security webhooks
by codesnips 3 tabs