Implementing a Webhook Notification

package main

import (
    "crypto"
    "crypto/rsa"
    "crypto/sha256"
    "crypto/x509"
    "encoding/base64"
    "io"
    "net/http"
    "time"
)

var publicKey = getPublicKey()

const timestampGrace = 5 * time.Minute

func kount360WebhookReceiver(
    w http.ResponseWriter,
    r *http.Request,
) {
    // Validate timestamp
    timestampHeader := r.Header.Get("X-Event-Timestamp")
    timestamp, err := time.Parse(time.RFC3339, timestampHeader)
    if err != nil {
        http.Error(w, "invalid timestamp", http.StatusBadRequest)
        return
    }

    if since := time.Since(timestamp); since > timestampGrace {
        http.Error(w, "timestamp too old", http.StatusBadRequest)
        return
    } else if since < -timestampGrace {
        http.Error(w, "timestamp too new", http.StatusBadRequest)
        return
    }

    // Read body
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "could not read body", http.StatusInternalServerError)
        return
    }

    // Create hash
    hasher := sha256.New()
    if _, err := hasher.Write([]byte(timestampHeader)); err != nil {
        http.Error(w, "could not read body", http.StatusInternalServerError)
        return
    }    
    if _, err := hasher.Write(body); err != nil {
        http.Error(w, "could not read body", http.StatusInternalServerError)
        return
    }

    // Signature
    sig, err := base64.StdEncoding.DecodeString(r.Header.Get("X-Event-Signature"))
    if err != nil {
        panic(err)
    }

    // Verify RSA PKCS #1 v1.5 signature.
    if err := rsa.VerifyPSS(publicKey, crypto.SHA256, hasher.Sum(nil), sig, nil); err != nil {
        http.Error(w, "could not verify signature", http.StatusForbidden)
        return
    }

    // Process message
    // ...

    w.WriteHeader(http.StatusOK)
}

func getPublicKey() *rsa.PublicKey {
    decoded, err := base64.StdEncoding.DecodeString(
        "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsQr7/3peYbbHkVsS0NlU4ziIFWKjjSI8HcWRSs6QOP6ZXrLXbvcOIuEFYA5ujThLuQfo05EzvWfVSdelbLJ39QNoFfOJ2YE4hq78/8OSloOU/E68M+rrFrxdS1QohsEuzoKD+9hyD2/3JE3vHpi82CjF1msVn9/fBDhYWvWQIOo16N435Wdfl62UZlAun+4TXYxUi+C2s67f58yPQN1uLEL+fa1L05TASqjINh0qjGIaz74g8lT05h/iDzPuTVGofFgTXUZh1yqA9p2P3I3UrK/jLv+aPkCpkwZltZVx99mk8uNVj4exlRC5kACQhvAbLgxiepmZR5XYyNJq1FPLsZuC27g1Squd7LL3Kdbv2tl4mjFG6P1FJwvve6qFVTq7cujEmq9yhfz16d7BPoT1+msZvoc22E7gTkuaW4cnckn7sbioA99zADcdb7OjzEuPd8NqGGD2Ldjg6eese8LF320XQ6jAc4dXcr6ZxVSSQyyI/qTlfi/3OoK7gSrGJT1MGZiohxx9kjt5z/G9fNoMlrQ/yJyLrTZxnlT+MVOsNtFYLZAV0XwVYQZ0a7PQ8hR4wwJxhfK84CcVUON+v4+vrj9bBDZH+boNIUFVDlpMiPjixunSs8FS9DfJ6UnG2YrlbHThgDmmZHj6sY/SUp4mcblBqGQwtxoTkCQqcJQxvAkCAwEAAQ==",
    )
    if err != nil {
        panic(err)
    }
    parsed, err := x509.ParsePKIXPublicKey(decoded)
    if err != nil {
        panic(err)
    }
    key, ok := parsed.(*rsa.PublicKey)
    if !ok {
        panic("could not typecast to rsa.PublicKey")
    }
    return key
}

import crypto from "crypto";
import express, { Request, Response } from "express";

const app = express();

const publicKeyBase64 = `MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsQr7/3peYbbHkVsS0NlU4ziIFWKjjSI8HcWRSs6QOP6ZXrLXbvcOIuEFYA5ujThLuQfo05EzvWfVSdelbLJ39QNoFfOJ2YE4hq78/8OSloOU/E68M+rrFrxdS1QohsEuzoKD+9hyD2/3JE3vHpi82CjF1msVn9/fBDhYWvWQIOo16N435Wdfl62UZlAun+4TXYxUi+C2s67f58yPQN1uLEL+fa1L05TASqjINh0qjGIaz74g8lT05h/iDzPuTVGofFgTXUZh1yqA9p2P3I3UrK/jLv+aPkCpkwZltZVx99mk8uNVj4exlRC5kACQhvAbLgxiepmZR5XYyNJq1FPLsZuC27g1Squd7LL3Kdbv2tl4mjFG6P1FJwvve6qFVTq7cujEmq9yhfz16d7BPoT1+msZvoc22E7gTkuaW4cnckn7sbioA99zADcdb7OjzEuPd8NqGGD2Ldjg6eese8LF320XQ6jAc4dXcr6ZxVSSQyyI/qTlfi/3OoK7gSrGJT1MGZiohxx9kjt5z/G9fNoMlrQ/yJyLrTZxnlT+MVOsNtFYLZAV0XwVYQZ0a7PQ8hR4wwJxhfK84CcVUON+v4+vrj9bBDZH+boNIUFVDlpMiPjixunSs8FS9DfJ6UnG2YrlbHThgDmmZHj6sY/SUp4mcblBqGQwtxoTkCQqcJQxvAkCAwEAAQ==`;
const publicKey = crypto.createPublicKey({
  key: Buffer.from(publicKeyBase64, "base64"),
  format: "der",
  type: "spki",
});

const timestampGrace = 5 * 60 * 1000; // 5 minutes in milliseconds

app.post("/webhook", (req: Request, res: Response) => {
  const timestampHeader = req.headers["x-event-timestamp"] as string;
  const signatureBase64 = req.headers["x-event-signature"] as string;
  if (!timestampHeader || !signatureBase64) {
    return res.status(400).send("Missing headers");
  }

  const timestamp = new Date(timestampHeader);
  const now = new Date();
  if (
    isNaN(timestamp.getTime()) ||
    now.getTime() - timestamp.getTime() > timestampGrace ||
    timestamp.getTime() - now.getTime() > timestampGrace
  ) {
    return res.status(400).send("Invalid timestamp");
  }

  const verifier = crypto.createVerify("RSA-SHA256");
  verifier.update(timestampHeader);
  verifier.update(JSON.stringify(req.body));
  const signature = Buffer.from(signatureBase64, "base64");

  if (!verifier.verify(publicKey, signature)) {
    return res.status(403).send("Could not verify signature");
  }

  // Process the valid webhook payload
  // ...

  res.sendStatus(200);
});