Signature des webhooks

POST /your-endpoint
X-IziPay-Signature: sha256=<hex>
X-IziPay-Timestamp: 1731843299
Content-Type: application/json

{"event":"payment_intent.completed","timestamp":1731843299,"data":{...}}

import { IziPayClient, IziPayWebhookError } from 'izichangepay-sdk';

try {
  const event = IziPayClient.validateWebhook(
    rawBody,                                    // Buffer brut, PAS du JSON parsé
    req.headers['x-izipay-signature'],
    process.env.IZIPAY_WEBHOOK_SECRET,
  );
  // event est typé : { type, timestamp, data }
} catch (err) {
  if (err instanceof IziPayWebhookError) {
    console.error('Webhook rejected:', err.reason);
    // reason ∈ 'missing_signature' | 'malformed_signature' | 'invalid_signature'
    //       | 'missing_timestamp' | 'expired_timestamp' | 'invalid_body'
  }
  return res.status(400).json({ error: 'invalid' });
}

import hmac
import hashlib
import time
import json

def validate_webhook(raw_body: bytes, signature_header: str, secret: str, tolerance_seconds=300):
    # 1. Parser le header
    if not signature_header.startswith('sha256='):
        raise ValueError('malformed signature')
    provided = signature_header[len('sha256='):]

    # 2. Calculer le HMAC attendu
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()

    # 3. Compare constant-time
    if not hmac.compare_digest(provided, expected):
        raise ValueError('invalid signature')

    # 4. Anti-replay
    payload = json.loads(raw_body)
    ts = payload.get('timestamp')
    if not isinstance(ts, (int, float)):
        raise ValueError('missing timestamp')
    age = time.time() - ts
    if age > tolerance_seconds:
        raise ValueError(f'replay attempt, age={age}s')
    if age < -60:
        raise ValueError('timestamp in future')

    return payload

function validateWebhook($rawBody, $sigHeader, $secret, $tolerance = 300) {
    if (substr($sigHeader, 0, 7) !== 'sha256=') {
        throw new Exception('malformed signature');
    }
    $provided = substr($sigHeader, 7);
    $expected = hash_hmac('sha256', $rawBody, $secret);
    if (!hash_equals($expected, $provided)) {
        throw new Exception('invalid signature');
    }
    $payload = json_decode($rawBody, true);
    $age = time() - ($payload['timestamp'] ?? 0);
    if ($age > $tolerance) throw new Exception('replay');
    if ($age < -60) throw new Exception('future');
    return $payload;
}

// Pendant la transition, acceptez l'un OU l'autre secret
function validateAny(rawBody, sig) {
  for (const secret of [NEW_SECRET, OLD_SECRET]) {
    try { return IziPayClient.validateWebhook(rawBody, sig, secret); } catch {}
  }
  return null;
}