Webhooks

import crypto from "crypto";

// IMPORTANT: verify against the raw request body string (before JSON parsing).
export function verifyTwentybaanWebhook(req) {
  const secret = process.env.TWENTYBAAN_WEBHOOK_SECRET || "";
  const timestamp = Number(req.header("X-TB-Timestamp") || 0);
  const sigHeader = req.header("X-TB-Signature") || "";
  const body = req.rawBody.toString("utf8");

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${body}`)
    .digest("hex");

  const provided = sigHeader.startsWith("sha256=")
    ? sigHeader.slice(7)
    : sigHeader;

  const ok =
    expected.length === provided.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(provided));

  if (!ok) {
    throw new Error("Invalid signature");
  }
}

import crypto from "crypto";
import type { Request } from "express";

type RequestWithRawBody = Request & { rawBody: Buffer };

// IMPORTANT: verify against the raw request body string (before JSON parsing).
export function verifyTwentybaanWebhook(req: RequestWithRawBody): void {
  const secret = process.env.TWENTYBAAN_WEBHOOK_SECRET || "";
  const timestamp = Number(req.header("X-TB-Timestamp") || 0);
  const sigHeader = req.header("X-TB-Signature") || "";
  const body = req.rawBody.toString("utf8");

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${body}`)
    .digest("hex");

  const provided = sigHeader.startsWith("sha256=")
    ? sigHeader.slice(7)
    : sigHeader;

  const ok =
    expected.length === provided.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(provided));

  if (!ok) {
    throw new Error("Invalid signature");
  }
}

import hashlib
import hmac
import os

# IMPORTANT: verify against the raw request body string (before JSON parsing).
def verify_twentybaan_webhook(headers, raw_body: str) -> None:
  secret = (os.environ.get("TWENTYBAAN_WEBHOOK_SECRET") or "").encode()
  timestamp = str(headers.get("X-TB-Timestamp") or "0")
  sig_header = str(headers.get("X-TB-Signature") or "")

  expected = hmac.new(
    secret,
    f"{timestamp}.{raw_body}".encode(),
    hashlib.sha256,
  ).hexdigest()

  provided = sig_header[7:] if sig_header.startswith("sha256=") else sig_header

  if not hmac.compare_digest(expected, provided):
    raise ValueError("Invalid signature")

<?php
$secret = $_ENV["TWENTYBAAN_WEBHOOK_SECRET"] ?? "";
$timestamp = (int) ($_SERVER["HTTP_X_TB_TIMESTAMP"] ?? 0);
$event = $_SERVER["HTTP_X_TB_EVENT"] ?? "";
$sigHeader = $_SERVER["HTTP_X_TB_SIGNATURE"] ?? "";

$body = file_get_contents("php://input") ?: "";

$expected = hash_hmac("sha256", $timestamp . "." . $body, $secret);
$provided = str_starts_with($sigHeader, "sha256=") ? substr($sigHeader, 7) : $sigHeader;

if (!hash_equals($expected, $provided)) {
  http_response_code(400);
  echo "Invalid signature";
  exit;
}

http_response_code(200);
echo "OK";

using System;
using System.Security.Cryptography;
using System.Text;

// IMPORTANT: verify against the raw request body string (before JSON parsing).
static void VerifyTwentybaanWebhook(
  string secret,
  string timestamp,
  string signatureHeader,
  string rawBody
) {
  var provided = signatureHeader.StartsWith("sha256=")
    ? signatureHeader.Substring(7)
    : signatureHeader;

  if (provided.Length != 64) {
    throw new Exception("Invalid signature");
  }

  var message = $"{timestamp}.{rawBody}";

  using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
  var expectedBytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
  var providedBytes = Convert.FromHexString(provided);

  if (!CryptographicOperations.FixedTimeEquals(expectedBytes, providedBytes)) {
    throw new Exception("Invalid signature");
  }
}

require "openssl"
require "rack/utils"

# IMPORTANT: verify against the raw request body string (before JSON parsing).
def verify_twentybaan_webhook(headers, raw_body)
  secret = ENV.fetch("TWENTYBAAN_WEBHOOK_SECRET", "")
  timestamp = headers["X-TB-Timestamp"].to_s
  sig_header = headers["X-TB-Signature"].to_s

  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}.#{raw_body}")
  provided = sig_header.start_with?("sha256=") ? sig_header[7..] : sig_header

  ok = Rack::Utils.secure_compare(expected, provided)
  raise "Invalid signature" unless ok
end

package webhooks

import (
  "crypto/hmac"
  "crypto/sha256"
  "crypto/subtle"
  "encoding/hex"
  "errors"
  "strings"
)

// Verify against the raw request body (before JSON parsing).
func VerifyTwentybaanWebhook(secret, timestamp, signatureHeader string, rawBody []byte) error {
  provided := strings.TrimPrefix(signatureHeader, "sha256=")
  providedBytes, err := hex.DecodeString(provided)
  if err != nil {
    return errors.New("invalid signature")
  }

  mac := hmac.New(sha256.New, []byte(secret))
  mac.Write([]byte(timestamp))
  mac.Write([]byte("."))
  mac.Write(rawBody)
  expected := mac.Sum(nil)

  if subtle.ConstantTimeCompare(expected, providedBytes) != 1 {
    return errors.New("invalid signature")
  }

  return nil
}