Configuration

const express = require("express");
const crypto = require("crypto");

const app = express();

// Keep the raw body: the signature is computed over the exact bytes Urtentic sent.
app.post("/webhooks/urtentic", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.get("x-urtentic-signature") ?? "";
  const expected = crypto
    .createHmac("sha256", Buffer.from(process.env.URTENTIC_WEBHOOK_SECRET, "base64"))
    .update(req.body)
    .digest("hex");

  const valid =
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expected, "hex"));
  if (!valid) {
    return res.status(401).send("Invalid signature");
  }

  const event = JSON.parse(req.body.toString("utf8"));
  // Store the event and process it asynchronously, then acknowledge quickly.
  console.log(`Received ${event.eventName} for ${event.resource}`);
  return res.sendStatus(200);
});

app.listen(3000);

import base64
import hashlib
import hmac
import json
import os

from flask import Flask, request

app = Flask(__name__)
SECRET = base64.b64decode(os.environ["URTENTIC_WEBHOOK_SECRET"])


@app.post("/webhooks/urtentic")
def urtentic_webhook():
    raw_body = request.get_data()  # the exact bytes Urtentic sent
    expected = hmac.new(SECRET, raw_body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(request.headers.get("x-urtentic-signature", ""), expected):
        return "Invalid signature", 401

    event = json.loads(raw_body)
    # Store the event and process it asynchronously, then acknowledge quickly.
    app.logger.info("Received %s for %s", event["eventName"], event["resource"])
    return "", 200

<?php
$rawBody = file_get_contents('php://input'); // the exact bytes Urtentic sent
$secret = base64_decode(getenv('URTENTIC_WEBHOOK_SECRET'));
$expected = hash_hmac('sha256', $rawBody, $secret);
$signature = $_SERVER['HTTP_X_URTENTIC_SIGNATURE'] ?? '';

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
// Store the event and process it asynchronously, then acknowledge quickly.
error_log("Received {$event['eventName']} for {$event['resource']}");
http_response_code(200);

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Base64;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
public class UrtenticWebhookController {

    @Value("${urtentic.webhook-secret}")
    private String webhookSecret;

    @PostMapping("/webhooks/urtentic")
    public ResponseEntity<Void> receive(@RequestHeader(value = "x-urtentic-signature", defaultValue = "") String signature,
                                        @RequestBody byte[] rawBody) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(Base64.getDecoder().decode(webhookSecret), "HmacSHA256"));
        String expected = HexFormat.of().formatHex(mac.doFinal(rawBody));

        if (!MessageDigest.isEqual(expected.getBytes(StandardCharsets.US_ASCII),
                signature.getBytes(StandardCharsets.US_ASCII))) {
            return ResponseEntity.status(401).build();
        }
        // Store the event and process it asynchronously, then acknowledge quickly.
        return ResponseEntity.ok().build();
    }
}