codesnips

hmac

ruby 
timestamp = request.headers.fetch('X-Signature-Timestamp')
signature = request.headers.fetch('X-Signature')
payload = request.raw_post

data = "#{timestamp}.#{payload}"
expected = OpenSSL::HMAC.hexdigest('SHA256', ENV.fetch('WEBHOOK_SECRET'), data)

HMAC signed API requests for webhook and partner integrity

hmac api-signing webhooks
by Kai Nakamura 2 tabs
ruby 
event_id = request.headers.fetch('X-Event-Id')
timestamp = request.headers.fetch('X-Signature-Timestamp').to_i

raise ActionController::BadRequest, 'stale request' if Time.now.to_i - timestamp > 300
raise ActionController::BadRequest, 'replay detected' if WebhookEvent.exists?(external_id: event_id)

Secure webhook endpoint design with replay protection

webhooks replay-protection hmac
by Kai Nakamura 1 tab
typescript 
import crypto from 'crypto';

interface VerifyOptions {
  rawBody: Buffer;
  signatureHeader: string | undefined;
  secret: string;

Webhook signature verification (timing-safe compare)

security webhooks hmac
by codesnips 3 tabs
ruby 
require 'sinatra/base'
require 'json'
require_relative 'signature_verifier'

class WebhookApp < Sinatra::Base
  configure do

Verifying Stripe Webhook Signatures in Sinatra with a before Filter

sinatra webhooks stripe
by codesnips 2 tabs
javascript 
const crypto = require('crypto');

function computeSignature(secret, timestamp, payload) {
  return crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`, 'utf8')

Verify Stripe-Style Webhook Signatures With HMAC in Express Before Processing

webhooks hmac security
by codesnips 2 tabs
go 
package session

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"

Stateless Session Cookies Signed and Verified With HMAC in Go

go security cookies
by codesnips 3 tabs
python 
import hashlib
import hmac
import time


class SignatureError(Exception):

Verify Stripe-Style Webhook HMAC Signatures Before Processing in Flask

flask webhooks hmac
by codesnips 3 tabs
ruby 
class User < ApplicationRecord
  has_secure_password

  RESET_TOKEN_TTL = 30.minutes

  def self.reset_verifier

Signed Password Reset Tokens with ActiveSupport::MessageVerifier in Rails

rails authentication password-reset
by codesnips 3 tabs
ruby 
class WebhookSignature
  class VerificationError < StandardError; end

  TOLERANCE = 300 # seconds

  def initialize(payload:, header:, secrets:)

Robust Webhook Verification (HMAC + Timestamp)

rails security webhooks
by codesnips 3 tabs
go 
package webhook

import (
	"encoding/json"
	"io"
	"net/http"

Verifying and Dispatching Stripe-Style Webhooks by Event Type in Go

webhooks go hmac
by codesnips 3 tabs
python 
import hmac
import hashlib
import time
from fastapi import Request, HTTPException, status

Verifying Stripe Webhook Signatures With a Reusable FastAPI Dependency

fastapi webhooks security
by codesnips 3 tabs