Webhook

import org.springframework.web.bind.annotation.*;
import org.springframework.http.ResponseEntity;
import org.springframework.http.HttpStatus;
import javax.servlet.http.HttpServletRequest;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.io.BufferedReader;
import java.nio.charset.StandardCharsets;
import java.util.Map;
 
@RestController
@RequestMapping("/webhook")
public class WebhookController {
    
    // Signing secret obtained from SUNBAY Copilot application details
    private static final String WEBHOOK_SECRET = "your_webhook_secret_key";
    
    @PostMapping("/notify")
    public ResponseEntity<Map<String, String>> handleWebhook(HttpServletRequest request) {
        try {
            // 1. Get request headers
            String signature = request.getHeader("X-Signature");
            String requestId = request.getHeader("X-Client-Request-Id");
            String timestamp = request.getHeader("X-Timestamp");
            
            // 2. Read raw request body (do not deserialize)
            String payload = getRequestBody(request);
            
            // 3. Verify signature
            if (!verifySignature(payload, signature, WEBHOOK_SECRET)) {
                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                    .body(Map.of("code", "INVALID_SIGNATURE", "message", "Signature verification failed"));
            }
            
            // 4. Verify timeliness (optional, prevent replay attacks)
            if (!verifyTimestamp(timestamp)) {
                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                    .body(Map.of("code", "EXPIRED", "message", "Request expired"));
            }
            
            // 5. Parse request body and process business logic
            WebhookNotifyRequest notifyRequest = JSON.parseObject(payload, WebhookNotifyRequest.class);
            processWebhook(notifyRequest, requestId);
            
            // 6. Return success response
            return ResponseEntity.ok(Map.of("code", "SUCCESS", "message", "Received"));
            
        } catch (Exception e) {
            log.error("Failed to process webhook", e);
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
                .body(Map.of("code", "ERROR", "message", "Internal error"));
        }
    }
    
    /**
     * Read raw request body
     */
    private String getRequestBody(HttpServletRequest request) throws Exception {
        StringBuilder sb = new StringBuilder();
        try (BufferedReader reader = request.getReader()) {
            String line;
            while ((line = reader.readLine()) != null) {
                sb.append(line);
            }
        }
        return sb.toString();
    }
    
    /**
     * Verify signature
     */
    private boolean verifySignature(String payload, String signature, String secret) {
        try {
            Mac mac = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKeySpec = new SecretKeySpec(
                secret.getBytes(StandardCharsets.UTF_8), 
                "HmacSHA256"
            );
            mac.init(secretKeySpec);
            
            byte[] hash = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
            String expectedSignature = bytesToHex(hash);
            
            return expectedSignature.equalsIgnoreCase(signature);
        } catch (Exception e) {
            log.error("Signature verification error", e);
            return false;
        }
    }
    
    /**
     * Convert byte array to hexadecimal string
     */
    private String bytesToHex(byte[] bytes) {
        StringBuilder result = new StringBuilder();
        for (byte b : bytes) {
            result.append(String.format("%02x", b));
        }
        return result.toString();
    }
    
    /**
     * Verify timeliness (optional)
     */
    private boolean verifyTimestamp(String timestamp) {
        try {
            long requestTime = Long.parseLong(timestamp);
            long currentTime = System.currentTimeMillis();
            // Only accept requests within 5 minutes
            return Math.abs(currentTime - requestTime) <= 5 * 60 * 1000;
        } catch (Exception e) {
            return false;
        }
    }
    
    /**
     * Process business logic (idempotent processing)
     */
    private void processWebhook(WebhookNotifyRequest request, String requestId) {
        // Check if already processed (idempotent)
        if (isAlreadyProcessed(request.getTransactionId())) {
            log.info("Transaction already processed: {}", request.getTransactionId());
            return;
        }
        
        // Execute business logic
        updateOrderStatus(request);
        
        // Mark as processed
        markAsProcessed(request.getTransactionId());
    }
}

const express = require('express');
const crypto = require('crypto');
 
const app = express();
const WEBHOOK_SECRET = 'your_webhook_secret_key';
 
// Use raw body parser
app.use(express.json({
  verify: (req, res, buf) => {
    // Save raw request body for signature verification
    req.rawBody = buf.toString('utf8');
  }
}));
 
app.post('/webhook/notify', async (req, res) => {
  try {
    // 1. Get request headers
    const signature = req.headers['x-signature'];
    const requestId = req.headers['x-client-request-id'];
    const timestamp = req.headers['x-timestamp'];
    
    // 2. Get raw request body
    const payload = req.rawBody;
    
    // 3. Verify signature
    if (!verifySignature(payload, signature, WEBHOOK_SECRET)) {
      return res.status(401).json({
        code: 'INVALID_SIGNATURE',
        message: 'Signature verification failed'
      });
    }
    
    // 4. Verify timeliness (optional)
    if (!verifyTimestamp(timestamp)) {
      return res.status(401).json({
        code: 'EXPIRED',
        message: 'Request expired'
      });
    }
    
    // 5. Process business logic
    const notifyRequest = req.body;
    await processWebhook(notifyRequest, requestId);
    
    // 6. Return success response
    res.json({
      code: 'SUCCESS',
      message: 'Received'
    });
    
  } catch (error) {
    console.error('Failed to process webhook:', error);
    res.status(500).json({
      code: 'ERROR',
      message: 'Internal error'
    });
  }
});
 
/**
 * Verify signature
 */
function verifySignature(payload, signature, secret) {
  try {
    const hmac = crypto.createHmac('sha256', secret);
    hmac.update(payload, 'utf8');
    const expectedSignature = hmac.digest('hex');
    
    return expectedSignature.toLowerCase() === signature.toLowerCase();
  } catch (error) {
    console.error('Signature verification error:', error);
    return false;
  }
}
 
/**
 * Verify timeliness (optional)
 */
function verifyTimestamp(timestamp) {
  try {
    const requestTime = parseInt(timestamp);
    const currentTime = Date.now();
    // Only accept requests within 5 minutes
    return Math.abs(currentTime - requestTime) <= 5 * 60 * 1000;
  } catch (error) {
    return false;
  }
}
 
/**
 * Process business logic (idempotent processing)
 */
async function processWebhook(request, requestId) {
  // Check if already processed (idempotent)
  if (await isAlreadyProcessed(request.transactionId)) {
    console.log(`Transaction already processed: ${request.transactionId}`);
    return;
  }
  
  // Execute business logic
  await updateOrderStatus(request);
  
  // Mark as processed
  await markAsProcessed(request.transactionId);
}
 
app.listen(3000, () => {
  console.log('Webhook server listening on port 3000');
});

package main
 
import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "io"
    "log"
    "net/http"
    "strconv"
    "time"
)
 
const WEBHOOK_SECRET = "your_webhook_secret_key"
 
type WebhookNotifyRequest struct {
    TransactionID        string `json:"transactionId"`
    TransactionRequestID string `json:"transactionRequestId"`
    ReferenceOrderID     string `json:"referenceOrderId"`
    TransactionStatus    string `json:"transactionStatus"`
    // ... other fields
}
 
type Response struct {
    Code    string `json:"code"`
    Message string `json:"message"`
}
 
func handleWebhook(w http.ResponseWriter, r *http.Request) {
    // 1. Get request headers
    signature := r.Header.Get("X-Signature")
    requestID := r.Header.Get("X-Client-Request-Id")
    timestamp := r.Header.Get("X-Timestamp")
    
    // 2. Read raw request body (do not deserialize)
    payload, err := io.ReadAll(r.Body)
    if err != nil {
        respondError(w, "ERROR", "Failed to read request body")
        return
    }
    defer r.Body.Close()
    
    // 3. Verify signature
    if !verifySignature(string(payload), signature, WEBHOOK_SECRET) {
        w.WriteHeader(http.StatusUnauthorized)
        respondError(w, "INVALID_SIGNATURE", "Signature verification failed")
        return
    }
    
    // 4. Verify timeliness (optional)
    if !verifyTimestamp(timestamp) {
        w.WriteHeader(http.StatusUnauthorized)
        respondError(w, "EXPIRED", "Request expired")
        return
    }
    
    // 5. Parse request body and process business logic
    var notifyRequest WebhookNotifyRequest
    if err := json.Unmarshal(payload, &notifyRequest); err != nil {
        respondError(w, "ERROR", "Invalid JSON")
        return
    }
    
    if err := processWebhook(&notifyRequest, requestID); err != nil {
        respondError(w, "ERROR", "Processing failed")
        return
    }
    
    // 6. Return success response
    respondSuccess(w, "SUCCESS", "Received")
}
 
// Verify signature
func verifySignature(payload, signature, secret string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(payload))
    expectedSignature := hex.EncodeToString(mac.Sum(nil))
    
    return expectedSignature == signature
}
 
// Verify timeliness (optional)
func verifyTimestamp(timestamp string) bool {
    requestTime, err := strconv.ParseInt(timestamp, 10, 64)
    if err != nil {
        return false
    }
    
    currentTime := time.Now().UnixMilli()
    // Only accept requests within 5 minutes
    return abs(currentTime-requestTime) <= 5*60*1000
}
 
// Process business logic (idempotent processing)
func processWebhook(request *WebhookNotifyRequest, requestID string) error {
    // Check if already processed (idempotent)
    if isAlreadyProcessed(request.TransactionID) {
        log.Printf("Transaction already processed: %s", request.TransactionID)
        return nil
    }
    
    // Execute business logic
    if err := updateOrderStatus(request); err != nil {
        return err
    }
    
    // Mark as processed
    return markAsProcessed(request.TransactionID)
}
 
func respondSuccess(w http.ResponseWriter, code, message string) {
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(Response{Code: code, Message: message})
}
 
func respondError(w http.ResponseWriter, code, message string) {
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(Response{Code: code, Message: message})
}
 
func abs(x int64) int64 {
    if x < 0 {
        return -x
    }
    return x
}
 
func main() {
    http.HandleFunc("/webhook/notify", handleWebhook)
    log.Println("Webhook server listening on port 8080")
    log.Fatal(http.ListenAndServe(":8080", nil))
}

from flask import Flask, request, jsonify
import hmac
import hashlib
import json
import time
 
app = Flask(__name__)
WEBHOOK_SECRET = 'your_webhook_secret_key'
 
@app.route('/webhook/notify', methods=['POST'])
def handle_webhook():
    try:
        # 1. Get request headers
        signature = request.headers.get('X-Signature')
        request_id = request.headers.get('X-Client-Request-Id')
        timestamp = request.headers.get('X-Timestamp')
        
        # 2. Get raw request body (do not deserialize)
        payload = request.get_data(as_text=True)
        
        # 3. Verify signature
        if not verify_signature(payload, signature, WEBHOOK_SECRET):
            return jsonify({
                'code': 'INVALID_SIGNATURE',
                'message': 'Signature verification failed'
            }), 401
        
        # 4. Verify timeliness (optional)
        if not verify_timestamp(timestamp):
            return jsonify({
                'code': 'EXPIRED',
                'message': 'Request expired'
            }), 401
        
        # 5. Parse request body and process business logic
        notify_request = json.loads(payload)
        process_webhook(notify_request, request_id)
        
        # 6. Return success response
        return jsonify({
            'code': 'SUCCESS',
            'message': 'Received'
        })
        
    except Exception as e:
        app.logger.error(f'Failed to process webhook: {e}')
        return jsonify({
            'code': 'ERROR',
            'message': 'Internal error'
        }), 500
 
def verify_signature(payload, signature, secret):
    """Verify signature"""
    try:
        expected_signature = hmac.new(
            secret.encode('utf-8'),
            payload.encode('utf-8'),
            hashlib.sha256
        ).hexdigest()
        
        return expected_signature.lower() == signature.lower()
    except Exception as e:
        app.logger.error(f'Signature verification error: {e}')
        return False
 
def verify_timestamp(timestamp):
    """Verify timeliness (optional)"""
    try:
        request_time = int(timestamp)
        current_time = int(time.time() * 1000)
        # Only accept requests within 5 minutes
        return abs(current_time - request_time) <= 5 * 60 * 1000
    except:
        return False
 
def process_webhook(request_data, request_id):
    """Process business logic (idempotent processing)"""
    transaction_id = request_data.get('transactionId')
    
    # Check if already processed (idempotent)
    if is_already_processed(transaction_id):
        app.logger.info(f'Transaction already processed: {transaction_id}')
        return
    
    # Execute business logic
    update_order_status(request_data)
    
    # Mark as processed
    mark_as_processed(transaction_id)
 
if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

<?php
 
// Signing secret obtained from SUNBAY Copilot application details
define('WEBHOOK_SECRET', 'your_webhook_secret_key');
 
// Handle Webhook request
function handleWebhook() {
    try {
        // 1. Get request headers
        $signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
        $requestId = $_SERVER['HTTP_X_CLIENT_REQUEST_ID'] ?? '';
        $timestamp = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';
        
        // 2. Get raw request body (do not deserialize)
        $payload = file_get_contents('php://input');
        
        // 3. Verify signature
        if (!verifySignature($payload, $signature, WEBHOOK_SECRET)) {
            http_response_code(401);
            echo json_encode([
                'code' => 'INVALID_SIGNATURE',
                'message' => 'Signature verification failed'
            ]);
            return;
        }
        
        // 4. Verify timeliness (optional)
        if (!verifyTimestamp($timestamp)) {
            http_response_code(401);
            echo json_encode([
                'code' => 'EXPIRED',
                'message' => 'Request expired'
            ]);
            return;
        }
        
        // 5. Parse request body and process business logic
        $notifyRequest = json_decode($payload, true);
        processWebhook($notifyRequest, $requestId);
        
        // 6. Return success response
        header('Content-Type: application/json');
        echo json_encode([
            'code' => 'SUCCESS',
            'message' => 'Received'
        ]);
        
    } catch (Exception $e) {
        error_log('Failed to process webhook: ' . $e->getMessage());
        http_response_code(500);
        echo json_encode([
            'code' => 'ERROR',
            'message' => 'Internal error'
        ]);
    }
}
 
/**
 * Verify signature
 */
function verifySignature($payload, $signature, $secret) {
    try {
        $expectedSignature = hash_hmac('sha256', $payload, $secret);
        return strtolower($expectedSignature) === strtolower($signature);
    } catch (Exception $e) {
        error_log('Signature verification error: ' . $e->getMessage());
        return false;
    }
}
 
/**
 * Verify timeliness (optional)
 */
function verifyTimestamp($timestamp) {
    try {
        $requestTime = intval($timestamp);
        $currentTime = intval(microtime(true) * 1000);
        // Only accept requests within 5 minutes
        return abs($currentTime - $requestTime) <= 5 * 60 * 1000;
    } catch (Exception $e) {
        return false;
    }
}
 
/**
 * Process business logic (idempotent processing)
 */
function processWebhook($request, $requestId) {
    $transactionId = $request['transactionId'] ?? '';
    
    // Check if already processed (idempotent)
    if (isAlreadyProcessed($transactionId)) {
        error_log("Transaction already processed: $transactionId");
        return;
    }
    
    // Execute business logic
    updateOrderStatus($request);
    
    // Mark as processed
    markAsProcessed($transactionId);
}
 
// Handle request
handleWebhook();

using Microsoft.AspNetCore.Mvc;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
 
[ApiController]
[Route("webhook")]
public class WebhookController : ControllerBase
{
    private const string WEBHOOK_SECRET = "your_webhook_secret_key";
    private readonly ILogger<WebhookController> _logger;
    
    public WebhookController(ILogger<WebhookController> logger)
    {
        _logger = logger;
    }
    
    [HttpPost("notify")]
    public async Task<IActionResult> HandleWebhook()
    {
        try
        {
            // 1. Get request headers
            var signature = Request.Headers["X-Signature"].ToString();
            var requestId = Request.Headers["X-Client-Request-Id"].ToString();
            var timestamp = Request.Headers["X-Timestamp"].ToString();
            
            // 2. Read raw request body (do not deserialize)
            using var reader = new StreamReader(Request.Body);
            var payload = await reader.ReadToEndAsync();
            
            // 3. Verify signature
            if (!VerifySignature(payload, signature, WEBHOOK_SECRET))
            {
                return Unauthorized(new
                {
                    code = "INVALID_SIGNATURE",
                    message = "Signature verification failed"
                });
            }
            
            // 4. Verify timeliness (optional)
            if (!VerifyTimestamp(timestamp))
            {
                return Unauthorized(new
                {
                    code = "EXPIRED",
                    message = "Request expired"
                });
            }
            
            // 5. Parse request body and process business logic
            var notifyRequest = JsonSerializer.Deserialize<WebhookNotifyRequest>(payload);
            await ProcessWebhook(notifyRequest, requestId);
            
            // 6. Return success response
            return Ok(new
            {
                code = "SUCCESS",
                message = "Received"
            });
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Failed to process webhook");
            return StatusCode(500, new
            {
                code = "ERROR",
                message = "Internal error"
            });
        }
    }
    
    /// <summary>
    /// Verify signature
    /// </summary>
    private bool VerifySignature(string payload, string signature, string secret)
    {
        try
        {
            using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
            var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
            var expectedSignature = BitConverter.ToString(hash)
                .Replace("-", "").ToLower();
            
            return expectedSignature.Equals(signature, StringComparison.OrdinalIgnoreCase);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Signature verification error");
            return false;
        }
    }
    
    /// <summary>
    /// Verify timeliness (optional)
    /// </summary>
    private bool VerifyTimestamp(string timestamp)
    {
        try
        {
            var requestTime = long.Parse(timestamp);
            var currentTime = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds();
            // Only accept requests within 5 minutes
            return Math.Abs(currentTime - requestTime) <= 5 * 60 * 1000;
        }
        catch
        {
            return false;
        }
    }
    
    /// <summary>
    /// Process business logic (idempotent processing)
    /// </summary>
    private async Task ProcessWebhook(WebhookNotifyRequest request, string requestId)
    {
        // Check if already processed (idempotent)
        if (await IsAlreadyProcessed(request.TransactionId))
        {
            _logger.LogInformation($"Transaction already processed: {request.TransactionId}");
            return;
        }
        
        // Execute business logic
        await UpdateOrderStatus(request);
        
        // Mark as processed
        await MarkAsProcessed(request.TransactionId);
    }
}
 
public class WebhookNotifyRequest
{
    public string TransactionId { get; set; }
    public string TransactionRequestId { get; set; }
    public string ReferenceOrderId { get; set; }
    public string TransactionStatus { get; set; }
    // ... other fields
}