Implementing a Webhook Notification

package main

import (
  "crypto"
  "crypto/rsa"
  "crypto/sha256"
  "crypto/x509"
  "encoding/base64"
  "io"
  "net/http"
  "time"
)

var publicKey = getPublicKey()

const timestampGrace = 5 * time.Minute

func kount360WebhookReceiver(
  w http.ResponseWriter,
  r *http.Request,
) {
  // Validate timestamp
  timestampHeader := r.Header.Get("X-Event-Timestamp")
  timestamp, err := time.Parse(time.RFC3339, timestampHeader)
  if err != nil {
    http.Error(w, "invalid timestamp", http.StatusBadRequest)
    return
  }

  if since := time.Since(timestamp); since > timestampGrace {
    http.Error(w, "timestamp too old", http.StatusBadRequest)
    return
  } else if since < -timestampGrace {
    http.Error(w, "timestamp too new", http.StatusBadRequest)
    return
  }

  // Read body
  body, err := io.ReadAll(r.Body)
  if err != nil {
    http.Error(w, "could not read body", http.StatusInternalServerError)
    return
  }

  // Create hash
  hasher := sha256.New()
  if _, err := hasher.Write([]byte(timestampHeader)); err != nil {
    http.Error(w, "could not read body", http.StatusInternalServerError)
    return
  }
  if _, err := hasher.Write(body); err != nil {
    http.Error(w, "could not read body", http.StatusInternalServerError)
    return
  }

  // Signature
  sig, err := base64.StdEncoding.DecodeString(r.Header.Get("X-Event-Signature"))
  if err != nil {
    panic(err)
  }

  // Verify RSA PKCS #1 v1.5 signature.
  if err := rsa.VerifyPKCS1v15(publicKey, crypto.SHA256, hasher.Sum(nil), sig); err != nil {
    http.Error(w, "could not verify signature", http.StatusForbidden)
    return
  }

  // Process message
  // ...

  w.WriteHeader(http.StatusOK)
}

func getPublicKey() *rsa.PublicKey {
  decoded, err := base64.StdEncoding.DecodeString(
    "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsQr7/3peYbbHkVsS0NlU4ziIFWKjjSI8HcWRSs6QOP6ZXrLXbvcOIuEFYA5ujThLuQfo05EzvWfVSdelbLJ39QNoFfOJ2YE4hq78/8OSloOU/E68M+rrFrxdS1QohsEuzoKD+9hyD2/3JE3vHpi82CjF1msVn9/fBDhYWvWQIOo16N435Wdfl62UZlAun+4TXYxUi+C2s67f58yPQN1uLEL+fa1L05TASqjINh0qjGIaz74g8lT05h/iDzPuTVGofFgTXUZh1yqA9p2P3I3UrK/jLv+aPkCpkwZltZVx99mk8uNVj4exlRC5kACQhvAbLgxiepmZR5XYyNJq1FPLsZuC27g1Squd7LL3Kdbv2tl4mjFG6P1FJwvve6qFVTq7cujEmq9yhfz16d7BPoT1+msZvoc22E7gTkuaW4cnckn7sbioA99zADcdb7OjzEuPd8NqGGD2Ldjg6eese8LF320XQ6jAc4dXcr6ZxVSSQyyI/qTlfi/3OoK7gSrGJT1MGZiohxx9kjt5z/G9fNoMlrQ/yJyLrTZxnlT+MVOsNtFYLZAV0XwVYQZ0a7PQ8hR4wwJxhfK84CcVUON+v4+vrj9bBDZH+boNIUFVDlpMiPjixunSs8FS9DfJ6UnG2YrlbHThgDmmZHj6sY/SUp4mcblBqGQwtxoTkCQqcJQxvAkCAwEAAQ==",
  )
  if err != nil {
    panic(err)
  }
  parsed, err := x509.ParsePKIXPublicKey(decoded)
  if err != nil {
    panic(err)
  }
  key, ok := parsed.(*rsa.PublicKey)
  if !ok {
    panic("could not typecast to rsa.PublicKey")
  }
  return key
}

import crypto from "crypto";
import express, { Request, Response } from "express";

const app = express();

const publicKeyBase64 = `MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsQr7/3peYbbHkVsS0NlU4ziIFWKjjSI8HcWRSs6QOP6ZXrLXbvcOIuEFYA5ujThLuQfo05EzvWfVSdelbLJ39QNoFfOJ2YE4hq78/8OSloOU/E68M+rrFrxdS1QohsEuzoKD+9hyD2/3JE3vHpi82CjF1msVn9/fBDhYWvWQIOo16N435Wdfl62UZlAun+4TXYxUi+C2s67f58yPQN1uLEL+fa1L05TASqjINh0qjGIaz74g8lT05h/iDzPuTVGofFgTXUZh1yqA9p2P3I3UrK/jLv+aPkCpkwZltZVx99mk8uNVj4exlRC5kACQhvAbLgxiepmZR5XYyNJq1FPLsZuC27g1Squd7LL3Kdbv2tl4mjFG6P1FJwvve6qFVTq7cujEmq9yhfz16d7BPoT1+msZvoc22E7gTkuaW4cnckn7sbioA99zADcdb7OjzEuPd8NqGGD2Ldjg6eese8LF320XQ6jAc4dXcr6ZxVSSQyyI/qTlfi/3OoK7gSrGJT1MGZiohxx9kjt5z/G9fNoMlrQ/yJyLrTZxnlT+MVOsNtFYLZAV0XwVYQZ0a7PQ8hR4wwJxhfK84CcVUON+v4+vrj9bBDZH+boNIUFVDlpMiPjixunSs8FS9DfJ6UnG2YrlbHThgDmmZHj6sY/SUp4mcblBqGQwtxoTkCQqcJQxvAkCAwEAAQ==`;
const publicKey = crypto.createPublicKey({
  key: Buffer.from(publicKeyBase64, "base64"),
  format: "der",
  type: "spki",
});

const timestampGrace = 5 * 60 * 1000; // 5 minutes in milliseconds

app.post("/webhook", (req: Request, res: Response) => {
  const timestampHeader = req.headers["x-event-timestamp"] as string;
  const signatureBase64 = req.headers["x-event-signature"] as string;
  if (!timestampHeader || !signatureBase64) {
    return res.status(400).send("Missing headers");
  }

  const timestamp = new Date(timestampHeader);
  const now = new Date();
  if (
    isNaN(timestamp.getTime()) ||
    now.getTime() - timestamp.getTime() > timestampGrace ||
    timestamp.getTime() - now.getTime() > timestampGrace
  ) {
    return res.status(400).send("Invalid timestamp");
  }

  const verifier = crypto.createVerify("RSA-SHA256");
  verifier.update(timestampHeader);
  verifier.update(JSON.stringify(req.body));
  const signature = Buffer.from(signatureBase64, "base64");

  if (!verifier.verify(publicKey, signature)) {
    return res.status(403).send("Could not verify signature");
  }

  // Process the valid webhook payload
  // ...

  res.sendStatus(200);
});