const express = require('express');
const crypto = require('crypto');

const app = express();

// Important: Use raw body middleware to access raw request data
app.use(express.raw({ type: 'application/json' }));

app.post('/webhook', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const secret = process.env.OPNFORM_WEBHOOK_SECRET;

  if (!signature || !secret) {
    return res.status(401).send('Unauthorized: Missing signature or secret');
  }

  // Calculate expected signature using raw body
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(req.body)
    .digest('hex');

  // Constant-time comparison to prevent timing attacks
  if (!crypto.timingSafeEqual(signature, expectedSignature)) {
    return res.status(401).send('Unauthorized: Invalid signature');
  }

  // Signature is valid, parse and process the webhook
  const data = JSON.parse(req.body);
  console.log('Webhook received:', data);

  res.status(200).send('Webhook received');
});

app.listen(3000, () => console.log('Webhook server running on port 3000'));

from flask import Flask, request
import hmac
import hashlib
import json
import os

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature')
    secret = os.environ.get('OPNFORM_WEBHOOK_SECRET')

    if not signature or not secret:
        return 'Unauthorized: Missing signature or secret', 401

    # Get raw request body
    raw_body = request.get_data()

    # Calculate expected signature
    expected_signature = 'sha256=' + hmac.new(
        secret.encode(),
        raw_body,
        hashlib.sha256
    ).hexdigest()

    # Constant-time comparison
    if not hmac.compare_digest(signature, expected_signature):
        return 'Unauthorized: Invalid signature', 401

    # Signature is valid, parse and process the webhook
    data = request.get_json()
    print('Webhook received:', data)

    return 'Webhook received', 200

if __name__ == '__main__':
    app.run(port=3000, debug=True)

<?php

use Illuminate\Http\Request;

Route::post('/webhook', function (Request $request) {
    $signature = $request->header('X-Webhook-Signature');
    $secret = env('OPNFORM_WEBHOOK_SECRET');

    if (!$signature || !$secret) {
        return response('Unauthorized: Missing signature or secret', 401);
    }

    // Get raw request body
    $rawBody = $request->getContent();

    // Calculate expected signature
    $expectedSignature = 'sha256=' . hash_hmac(
        'sha256',
        $rawBody,
        $secret
    );

    // Constant-time comparison
    if (!hash_equals($signature, $expectedSignature)) {
        return response('Unauthorized: Invalid signature', 401);
    }

    // Signature is valid, parse and process the webhook
    $data = $request->json()->all();
    \Log::info('Webhook received:', $data);

    return response('Webhook received', 200);
});

# Generate a webhook secret for testing
SECRET="whsec_1234567890abcdefghijklmnopqr"
BODY='{"form_title":"My Form","submission":{"email":"test@example.com"}}'

# Calculate signature
SIGNATURE="sha256=$(echo -n "$BODY" | openssl dgst -sha256 -hmac "$SECRET" -hex | cut -d' ' -f2)"

# Send webhook request
curl -X POST http://localhost:3000/webhook \
  -H "Content-Type: application/json" \
  -H "X-Webhook-Signature: $SIGNATURE" \
  -d "$BODY"