# Verify your endpoint is reachable
curl -X POST https://your-endpoint.example.com/webhooks \
  -H "Content-Type: application/json" \
  -d '{"test": true}'

<?php
// webhooks/handler.php

// Read the raw POST body (required for signature verification)
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';
$webhookToken = getenv('WEBHOOK_SIGNING_SECRET');

// Verify signature FIRST
// Signature is computed as: HMAC-SHA256(timestamp + "." + body, secret)
$signedContent = $timestamp . '.' . $payload;
$expectedSignature = hash_hmac('sha256', $signedContent, $webhookToken);
if (!hash_equals($expectedSignature, $signature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

// Parse event
$event = json_decode($payload, true);

// Route by event type
switch ($event['event_type']) {
    case 'order.created':
        handleOrderCreated($event['data']);
        break;
    case 'order.pending':
        handleOrderPending($event['data']);
        break;
    case 'order.delivered':
        handleOrderDelivered($event['data']);
        break;
    case 'order.partially_delivered':
        handleOrderPartiallyDelivered($event['data']);
        break;
    case 'order.cancelled':
        handleOrderCancelled($event['data']);
        break;
}

// Return 200 to acknowledge receipt
http_response_code(200);
echo json_encode(['status' => 'ok']);

function handleOrderCreated(array $order): void {
    error_log("Order created: {$order['reference_code']}");
}

function handleOrderPending(array $order): void {
    error_log("Order pending: {$order['reference_code']}");
}

function handleOrderDelivered(array $order): void {
    foreach ($order['order_items'] ?? [] as $item) {
        foreach ($item['vouchers'] ?? [] as $voucher) {
            // Store voucher, deliver to end-user, etc.
            error_log("Voucher received: {$voucher['voucher_reference_number']}");
        }
    }
}

function handleOrderPartiallyDelivered(array $order): void {
    error_log("Partial delivery for order: {$order['reference_code']}");
}

function handleOrderCancelled(array $order): void {
    error_log("Order cancelled: {$order['reference_code']}");
}
?>

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, timestamp, secret) {
  const signedContent = `${timestamp}.${payload}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(signedContent)
    .digest('hex');

  // Timing-safe comparison to prevent timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(signature, 'hex')
  );
}

// Express.js middleware example
app.post('/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  const payload = req.body.toString();
  const signature = req.headers['x-signature'];
  const timestamp = req.headers['x-timestamp'];
  const secret = process.env.WEBHOOK_SIGNING_SECRET;

  // Reject stale requests (> 5 minutes old)
  const age = Math.floor(Date.now() / 1000) - parseInt(timestamp, 10);
  if (age > 300) {
    return res.status(401).json({ error: 'Timestamp too old' });
  }

  if (!verifyWebhookSignature(payload, signature, timestamp, secret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(payload);
  // Process event...
  res.json({ status: 'ok' });
});

import hmac
import hashlib
import time
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = os.environ["WEBHOOK_SIGNING_SECRET"]

def verify_webhook_signature(payload: bytes, signature: str, timestamp: str, secret: str) -> bool:
    signed_content = f"{timestamp}.".encode() + payload
    expected = hmac.new(
        secret.encode(),
        signed_content,
        hashlib.sha256
    ).hexdigest()

    # Timing-safe comparison
    return hmac.compare_digest(expected, signature)

@app.route('/webhooks', methods=['POST'])
def webhook_handler():
    payload = request.get_data()
    signature = request.headers.get('X-Signature', '')
    timestamp = request.headers.get('X-Timestamp', '')

    # Reject stale requests (> 5 minutes old)
    age = abs(int(time.time()) - int(timestamp))
    if age > 300:
        return jsonify({'error': 'Timestamp too old'}), 401

    if not verify_webhook_signature(payload, signature, timestamp, WEBHOOK_SECRET):
        return jsonify({'error': 'Invalid signature'}), 401

    event = request.get_json()
    # Process event...
    return jsonify({'status': 'ok'})

<?php
function verifyWebhookSignature(string $payload, string $signature, string $timestamp, string $secret): bool {
    $signedContent = $timestamp . '.' . $payload;
    $expected = hash_hmac('sha256', $signedContent, $secret);

    // Timing-safe comparison
    return hash_equals($expected, $signature);
}

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';
$secret = getenv('WEBHOOK_SIGNING_SECRET');

// Reject stale requests (> 5 minutes old)
if (abs(time() - intval($timestamp)) > 300) {
    http_response_code(401);
    die(json_encode(['error' => 'Timestamp too old']));
}

if (!verifyWebhookSignature($payload, $signature, $timestamp, $secret)) {
    http_response_code(401);
    die(json_encode(['error' => 'Invalid signature']));
}

$event = json_decode($payload, true);
// Process event...
?>

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "math"
    "net/http"
    "os"
    "strconv"
    "time"
)

func verifySignature(payload []byte, signature, timestamp, secret string) bool {
    signedContent := fmt.Sprintf("%s.%s", timestamp, string(payload))

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(signedContent))
    expected := hex.EncodeToString(mac.Sum(nil))

    return hmac.Equal([]byte(expected), []byte(signature))
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    payload, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Bad request", http.StatusBadRequest)
        return
    }
    defer r.Body.Close()

    signature := r.Header.Get("X-Signature")
    timestamp := r.Header.Get("X-Timestamp")
    secret := os.Getenv("WEBHOOK_SIGNING_SECRET")

    // Reject stale requests (> 5 minutes old)
    ts, _ := strconv.ParseInt(timestamp, 10, 64)
    age := math.Abs(float64(time.Now().Unix() - ts))
    if age > 300 {
        http.Error(w, `{"error":"Timestamp too old"}`, http.StatusUnauthorized)
        return
    }

    if !verifySignature(payload, signature, timestamp, secret) {
        http.Error(w, `{"error":"Invalid signature"}`, http.StatusUnauthorized)
        return
    }

    var event map[string]interface{}
    json.Unmarshal(payload, &event)
    // Process event...

    w.Header().Set("Content-Type", "application/json")
    w.WriteHeader(http.StatusOK)
    w.Write([]byte(`{"status":"ok"}`))
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import java.util.Map;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
public class WebhookController {

    @Value("${webhook.signing.secret}")
    private String webhookSecret;

    @PostMapping("/webhooks")
    public ResponseEntity<Map<String, String>> handleWebhook(
            @RequestBody String payload,
            @RequestHeader("X-Signature") String signature,
            @RequestHeader("X-Timestamp") String timestamp) throws Exception {

        // Reject stale requests (> 5 minutes old)
        long age = Math.abs(System.currentTimeMillis() / 1000 - Long.parseLong(timestamp));
        if (age > 300) {
            return ResponseEntity.status(401).body(Map.of("error", "Timestamp too old"));
        }

        if (!verifySignature(payload, signature, timestamp, webhookSecret)) {
            return ResponseEntity.status(401).body(Map.of("error", "Invalid signature"));
        }

        // Process event...
        return ResponseEntity.ok(Map.of("status", "ok"));
    }

    private boolean verifySignature(String payload, String signature, String timestamp, String secret)
            throws Exception {
        String signedContent = timestamp + "." + payload;

        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes("UTF-8"), "HmacSHA256"));
        byte[] hash = mac.doFinal(signedContent.getBytes("UTF-8"));

        String expected = bytesToHex(hash);

        // Timing-safe comparison
        return MessageDigest.isEqual(
            expected.getBytes("UTF-8"),
            signature.getBytes("UTF-8")
        );
    }

    private String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }
}

# Manually verify a signature (useful for debugging)
PAYLOAD='{"event_id":"evt_2kT7xR9vBqMf4Np1","event_type":"order.delivered"}'
SECRET="whsec_a1b2c3d4e5f6g7h8i9j0"
TIMESTAMP="1708800000"

# Compute expected signature: HMAC-SHA256(timestamp + "." + body, secret)
EXPECTED=$(echo -n "${TIMESTAMP}.${PAYLOAD}" | \
  openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)

echo "Expected: $EXPECTED"

# Compare with the X-Signature header value from the request
RECEIVED="a3f2b8c9d1e4..."
if [ "$EXPECTED" = "$RECEIVED" ]; then
  echo "Signature valid"
else
  echo "Signature INVALID -- reject this request"
fi

# Simulate a signed webhook delivery for local testing
TIMESTAMP=$(date +%s)
PAYLOAD='{"event_type":"order.delivered","data":{"id":123}}'
SECRET='whsec_a1b2c3d4e5f6g7h8i9j0'

curl -X POST https://your-endpoint.example.com/webhooks \
  -H "Content-Type: application/json" \
  -H "X-Event-Type: order.delivered" \
  -H "X-Event-ID: evt_test_2kT7xR9vBqMf" \
  -H "X-Timestamp: $TIMESTAMP" \
  -H "X-Signature: $(echo -n "${TIMESTAMP}.${PAYLOAD}" | openssl dgst -sha256 -hmac "$SECRET" | cut -d' ' -f2)" \
  -d "$PAYLOAD"

<?php
// Production-ready webhook handler with idempotency

class WebhookHandler {
    private string $secret;
    private PDO $db;

    public function __construct(string $secret, PDO $db) {
        $this->secret = $secret;
        $this->db = $db;
    }

    public function handle(): void {
        // 1. Read raw payload
        $payload = file_get_contents('php://input');

        // 2. Verify signature
        $signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
        $timestamp = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';

        if (abs(time() - intval($timestamp)) > 300) {
            $this->respond(401, ['error' => 'Timestamp too old']);
            return;
        }

        if (!$this->verifySignature($payload, $signature, $timestamp)) {
            $this->respond(401, ['error' => 'Invalid signature']);
            return;
        }

        // 3. Parse event
        $event = json_decode($payload, true);
        if (!$event) {
            $this->respond(400, ['error' => 'Invalid JSON']);
            return;
        }

        $eventId = $event['event_id'] ?? '';

        // 4. Idempotency check -- skip duplicate deliveries
        if ($this->isDuplicateEvent($eventId)) {
            $this->respond(200, ['status' => 'ok', 'note' => 'duplicate']);
            return;
        }

        // 5. Acknowledge receipt immediately
        $this->respond(200, ['status' => 'ok']);

        // 6. Process the event (after responding)
        try {
            $this->processEvent($event);
            $this->markEventProcessed($eventId);
        } catch (Exception $e) {
            error_log("Webhook processing error: {$e->getMessage()}");
        }
    }

    private function verifySignature(string $payload, string $signature, string $timestamp): bool {
        $signedContent = $timestamp . '.' . $payload;
        $expected = hash_hmac('sha256', $signedContent, $this->secret);
        return hash_equals($expected, $signature);
    }

    private function isDuplicateEvent(string $eventId): bool {
        $stmt = $this->db->prepare(
            'SELECT 1 FROM webhook_events WHERE event_id = ? LIMIT 1'
        );
        $stmt->execute([$eventId]);
        return (bool) $stmt->fetch();
    }

    private function markEventProcessed(string $eventId): void {
        $stmt = $this->db->prepare(
            'INSERT INTO webhook_events (event_id, processed_at) VALUES (?, NOW())'
        );
        $stmt->execute([$eventId]);
    }

    private function processEvent(array $event): void {
        $data = $event['data'] ?? [];

        switch ($event['event_type']) {
            case 'order.created':
                $this->handleOrderCreated($data);
                break;
            case 'order.pending':
                $this->handleOrderPending($data);
                break;
            case 'order.delivered':
                $this->handleOrderDelivered($data);
                break;
            case 'order.partially_delivered':
                $this->handleOrderPartiallyDelivered($data);
                break;
            case 'order.cancelled':
                $this->handleOrderCancelled($data);
                break;
        }
    }

    private function handleOrderCreated(array $order): void {
        error_log("Order created: {$order['reference_code']}");
    }

    private function handleOrderPending(array $order): void {
        error_log("Order pending: {$order['reference_code']}");
    }

    private function handleOrderDelivered(array $order): void {
        foreach ($order['order_items'] ?? [] as $item) {
            foreach ($item['vouchers'] ?? [] as $voucher) {
                $this->storeVoucher($order['reference_code'], $voucher);
                $this->notifyCustomer($order, $voucher);
            }
        }
    }

    private function handleOrderPartiallyDelivered(array $order): void {
        error_log("Partial delivery: {$order['reference_code']}");
    }

    private function handleOrderCancelled(array $order): void {
        error_log("Order cancelled: {$order['reference_code']}");
        // Update your records, issue refunds, notify customers, etc.
    }

    private function storeVoucher(string $orderRef, array $voucher): void {
        // Persist voucher details to your database
    }

    private function notifyCustomer(array $order, array $voucher): void {
        // Send email, SMS, or push notification
    }

    private function respond(int $code, array $data): void {
        http_response_code($code);
        header('Content-Type: application/json');
        echo json_encode($data);
        if ($code === 200 && function_exists('fastcgi_finish_request')) {
            fastcgi_finish_request();
        }
    }
}

// Usage
$db = new PDO('mysql:host=localhost;dbname=your_database', 'user', 'password');
$handler = new WebhookHandler(getenv('WEBHOOK_SIGNING_SECRET'), $db);
$handler->handle();
?>