Webhook

const crypto = require('crypto')
 
function validateWebhookSignature(req) {
  const signature = req.headers['x-webhook-signature']
  const timestamp = req.headers['x-webhook-timestamp']
  const body = JSON.stringify(req.body)
 
  // ตรวจสอบ timestamp ไม่เก่าเกิน 5 นาที
  const currentTime = Math.floor(Date.now() / 1000)
  if (currentTime - parseInt(timestamp) > 300) {
    throw new Error('Webhook timestamp expired')
  }
 
  // สร้าง signature
  const payload = `${timestamp}.${body}`
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(payload)
    .digest('hex')
 
  // เปรียบเทียบ signature (timing-safe)
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    throw new Error('Invalid webhook signature')
  }
 
  return true
}
 
// Express.js example
app.post('/api/webhooks/humansoft', (req, res) => {
  try {
    validateWebhookSignature(req)
 
    const event = req.headers['x-webhook-event']
    const data = req.body
 
    switch (event) {
      case 'employee.create':
        handleEmployeeCreate(data)
        break
      case 'employee.terminate':
        handleEmployeeTerminate(data)
        break
      // ... handle other events
    }
 
    res.status(200).json({ received: true })
  } catch (error) {
    console.error('Webhook error:', error.message)
    res.status(400).json({ error: error.message })
  }
})

import hmac
import hashlib
import time
from flask import Flask, request, jsonify
 
app = Flask(__name__)
WEBHOOK_SECRET = "your_secret_token"
 
def validate_webhook_signature(request):
    signature = request.headers.get('X-Webhook-Signature', '')
    timestamp = request.headers.get('X-Webhook-Timestamp', '')
    body = request.get_data(as_text=True)
 
    # ตรวจสอบ timestamp ไม่เก่าเกิน 5 นาที
    current_time = int(time.time())
    if current_time - int(timestamp) > 300:
        raise ValueError('Webhook timestamp expired')
 
    # สร้าง signature
    payload = f"{timestamp}.{body}"
    expected_signature = 'sha256=' + hmac.new(
        WEBHOOK_SECRET.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
 
    # เปรียบเทียบ signature
    if not hmac.compare_digest(signature, expected_signature):
        raise ValueError('Invalid webhook signature')
 
    return True
 
@app.route('/api/webhooks/humansoft', methods=['POST'])
def handle_webhook():
    try:
        validate_webhook_signature(request)
 
        event = request.headers.get('X-Webhook-Event')
        data = request.json
 
        if event == 'employee.create':
            handle_employee_create(data)
        elif event == 'employee.terminate':
            handle_employee_terminate(data)
        # ... handle other events
 
        return jsonify({'received': True}), 200
    except ValueError as e:
        return jsonify({'error': str(e)}), 400

<?php
 
function validateWebhookSignature() {
    $signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
    $timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '';
    $body = file_get_contents('php://input');
 
    $webhookSecret = getenv('WEBHOOK_SECRET');
 
    // ตรวจสอบ timestamp ไม่เก่าเกิน 5 นาที
    $currentTime = time();
    if ($currentTime - intval($timestamp) > 300) {
        throw new Exception('Webhook timestamp expired');
    }
 
    // สร้าง signature
    $payload = $timestamp . '.' . $body;
    $expectedSignature = 'sha256=' . hash_hmac('sha256', $payload, $webhookSecret);
 
    // เปรียบเทียบ signature (timing-safe)
    if (!hash_equals($signature, $expectedSignature)) {
        throw new Exception('Invalid webhook signature');
    }
 
    return true;
}
 
// Handle webhook
try {
    validateWebhookSignature();
 
    $event = $_SERVER['HTTP_X_WEBHOOK_EVENT'] ?? '';
    $data = json_decode(file_get_contents('php://input'), true);
 
    switch ($event) {
        case 'employee.create':
            handleEmployeeCreate($data);
            break;
        case 'employee.terminate':
            handleEmployeeTerminate($data);
            break;
        // ... handle other events
    }
 
    http_response_code(200);
    echo json_encode(['received' => true]);
} catch (Exception $e) {
    http_response_code(400);
    echo json_encode(['error' => $e->getMessage()]);
}
?>

package main
 
import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
    "strconv"
    "time"
)
 
func validateWebhookSignature(r *http.Request, body []byte) error {
    signature := r.Header.Get("X-Webhook-Signature")
    timestamp := r.Header.Get("X-Webhook-Timestamp")
    webhookSecret := os.Getenv("WEBHOOK_SECRET")
 
    // ตรวจสอบ timestamp ไม่เก่าเกิน 5 นาที
    ts, _ := strconv.ParseInt(timestamp, 10, 64)
    if time.Now().Unix()-ts > 300 {
        return fmt.Errorf("webhook timestamp expired")
    }
 
    // สร้าง signature
    payload := fmt.Sprintf("%s.%s", timestamp, string(body))
    mac := hmac.New(sha256.New, []byte(webhookSecret))
    mac.Write([]byte(payload))
    expectedSignature := "sha256=" + hex.EncodeToString(mac.Sum(nil))
 
    // เปรียบเทียบ signature
    if !hmac.Equal([]byte(signature), []byte(expectedSignature)) {
        return fmt.Errorf("invalid webhook signature")
    }
 
    return nil
}
 
func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
 
    if err := validateWebhookSignature(r, body); err != nil {
        http.Error(w, err.Error(), http.StatusBadRequest)
        return
    }
 
    event := r.Header.Get("X-Webhook-Event")
    var data map[string]interface{}
    json.Unmarshal(body, &data)
 
    switch event {
    case "employee.create":
        handleEmployeeCreate(data)
    case "employee.terminate":
        handleEmployeeTerminate(data)
    }
 
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string]bool{"received": true})
}