Security & Best Practices

const express = require('express');
const crypto = require('crypto');

const app = express();

// IMPORTANT: Use raw body for signature verification
app.use('/webhooks/bookingshake', express.raw({ type: 'application/json' }));

app.post('/webhooks/bookingshake', (req, res) => {
  const signature = req.headers['bookingshake-signature'];
  const secret = process.env.BOOKINGSHAKE_WEBHOOK_SECRET;

  // Compute expected signature from raw body
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(req.body)
    .digest('hex');

  // Verify signature
  if (signature !== expectedSignature) {
    console.error('Invalid webhook signature');
    return res.status(401).send('Invalid signature');
  }

  // Parse webhook payload
  const webhook = JSON.parse(req.body);
  console.log('Verified event:', webhook.event);
  console.log('Data:', webhook.data);

  // Process webhook asynchronously to respond quickly
  processWebhook(webhook).catch(err => {
    console.error('Error processing webhook:', err);
  });

  // Respond immediately (< 5 seconds)
  res.status(200).send('OK');
});

async function processWebhook(webhook) {
  // Your business logic here
  switch (webhook.event) {
    case 'contact.created':
      await syncContactToExternalCRM(webhook.data);
      break;
    case 'account.created':
      await syncAccountToExternalCRM(webhook.data);
      break;
    // Handle other events...
  }
}

app.listen(3000, () => {
  console.log('Webhook server listening on port 3000');
});

from flask import Flask, request, jsonify
import hmac
import hashlib
import json
import os

app = Flask(__name__)

@app.route('/webhooks/bookingshake', methods=['POST'])
def webhook():
    # Get signature from header
    signature = request.headers.get('Bookingshake-Signature')
    secret = os.environ.get('BOOKINGSHAKE_WEBHOOK_SECRET')

    # Get raw request body
    raw_body = request.data

    # Compute expected signature
    expected_signature = hmac.new(
        secret.encode('utf-8'),
        raw_body,
        hashlib.sha256
    ).hexdigest()

    # Verify signature
    if signature != expected_signature:
        print('Invalid webhook signature')
        return 'Invalid signature', 401

    # Parse webhook payload
    webhook = request.get_json()
    print(f"Verified event: {webhook['event']}")
    print(f"Data: {webhook['data']}")

    # Process webhook asynchronously
    process_webhook(webhook)

    # Respond quickly
    return 'OK', 200

def process_webhook(webhook):
    # Your business logic here
    event_type = webhook['event']

    if event_type == 'contact.created':
        sync_contact_to_crm(webhook['data'])
    elif event_type == 'account.created':
        sync_account_to_crm(webhook['data'])
    # Handle other events...

if __name__ == '__main__':
    app.run(port=3000)

<?php

// Get raw POST body (IMPORTANT: Don't use php://input with JSON parsing first)
$rawBody = file_get_contents('php://input');

// Get signature from header
$signature = $_SERVER['HTTP_BOOKINGSHAKE_SIGNATURE'] ?? '';
$secret = getenv('BOOKINGSHAKE_WEBHOOK_SECRET');

// Compute expected signature
$expectedSignature = hash_hmac('sha256', $rawBody, $secret);

// Verify signature
if ($signature !== $expectedSignature) {
    error_log('Invalid webhook signature');
    http_response_code(401);
    exit('Invalid signature');
}

// Parse webhook payload
$webhook = json_decode($rawBody, true);
error_log("Verified event: " . $webhook['event']);
error_log("Data: " . json_encode($webhook['data']));

// Process webhook asynchronously
processWebhook($webhook);

// Respond quickly
http_response_code(200);
echo 'OK';

function processWebhook($webhook) {
    // Your business logic here
    switch ($webhook['event']) {
        case 'contact.created':
            syncContactToCRM($webhook['data']);
            break;
        case 'account.created':
            syncAccountToCRM($webhook['data']);
            break;
        // Handle other events...
    }
}

const Redis = require('redis');
const redis = Redis.createClient();

app.post('/webhooks/bookingshake', async (req, res) => {
  // ... verify signature first ...

  const idempotencyKey = req.headers['idempotency-key'];

  // Check if we've already processed this webhook
  const alreadyProcessed = await redis.get(`webhook:${idempotencyKey}`);
  if (alreadyProcessed) {
    console.log('Webhook already processed');
    return res.status(200).send('Already processed');
  }

  // Parse and process webhook
  const webhook = JSON.parse(req.body);
  await processWebhook(webhook);

  // Mark as processed (expire after 24 hours)
  await redis.setex(`webhook:${idempotencyKey}`, 86400, 'processed');

  res.status(200).send('OK');
});

app.post('/webhooks/bookingshake', async (req, res) => {
  // ... verify signature first ...

  const idempotencyKey = req.headers['idempotency-key'];

  // Check database for this idempotency key
  const existing = await db.query(
    'SELECT id FROM processed_webhooks WHERE idempotency_key = ?',
    [idempotencyKey]
  );

  if (existing.length > 0) {
    return res.status(200).send('Already processed');
  }

  // Process webhook
  const webhook = JSON.parse(req.body);
  await processWebhook(webhook);

  // Store idempotency key
  await db.query(
    'INSERT INTO processed_webhooks (idempotency_key, processed_at) VALUES (?, NOW())',
    [idempotencyKey]
  );

  res.status(200).send('OK');
});

# Simple in-memory approach (use Redis/DB for production)
processed_webhooks = set()

@app.route('/webhooks/bookingshake', methods=['POST'])
def webhook():
    # ... verify signature first ...

    idempotency_key = request.headers.get('Idempotency-Key')

    # Check if already processed
    if idempotency_key in processed_webhooks:
        return 'Already processed', 200

    # Process webhook
    webhook = request.get_json()
    process_webhook(webhook)

    # Mark as processed
    processed_webhooks.add(idempotency_key)

    return 'OK', 200