Verify webhook signatures

// express.raw() on this route, registered before any app.use(express.json()): the signature
// covers the exact bytes we sent, and a parsed-then-re-serialised body is not those bytes.
app.post('/webhooks/revoply', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyRevoplySignature(req.body, req.get('X-Revoply-Signature'), secret)) {
    return res.status(400).send('Invalid signature');
  }

  const event = JSON.parse(req.body.toString('utf8'));

  // The same event can arrive more than once: acknowledge a repeat and do nothing.
  if (handled.has(event.id)) return res.sendStatus(200);
  handled.add(event.id);

  // Answer within 10 seconds, then do the work.
  res.sendStatus(200);
  setImmediate(() => handleEvent(event));
});

@app.post("/webhooks/revoply")
def revoply_webhook():
    # get_data() is the body as it arrived. Never verify json.dumps(request.json):
    # re-serialised JSON is not the bytes we signed.
    raw_body = request.get_data()
    if not verify_revoply_signature(raw_body, request.headers.get("X-Revoply-Signature"), SECRET):
        return "Invalid signature", 400

    event = json.loads(raw_body)
    if event["id"] in handled:
        return "", 200
    handled.add(event["id"])

    # Answer within 10 seconds; hand slow work to a queue.
    print(event["type"], "(test)" if event["test"] else "")
    return "", 200

public function __invoke(Request $request)
{
    // getContent() is the body as it arrived. Never verify json_encode($request->all()):
    // re-encoded JSON is not the bytes we signed.
    $rawBody = $request->getContent();

    if (!revoply_verify_signature($rawBody, $request->header('X-Revoply-Signature'), (string) config('services.revoply.webhook_secret'))) {
        return response('Invalid signature', 400);
    }

    $event = json_decode($rawBody, true);

    // The same event can arrive more than once: acknowledge a repeat and do nothing.
    if (!Cache::add('revoply-event:' . $event['id'], true, now()->addDays(30))) {
        return response('', 200);
    }

    // Answer within 10 seconds; queue slow work (dispatch a job) instead of doing it here.
    logger()->info('RevoplyAI event', ['type' => $event['type'], 'test' => $event['test']]);

    return response('', 200);
}

// php://input is the body as it arrived; $_POST is empty for JSON.
$rawBody = file_get_contents('php://input');

if (!revoply_verify_signature($rawBody, $_SERVER['HTTP_X_REVOPLY_SIGNATURE'] ?? null, (string) getenv('REVOPLY_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true, 512, JSON_THROW_ON_ERROR);

// Deduplicate on $event['id'] in your database, then answer within 10 seconds.
error_log(sprintf('RevoplyAI %s %s%s', $event['id'], $event['type'], $event['test'] ? ' (test)' : ''));
http_response_code(200);

app.MapPost("/webhooks/revoply", async (HttpRequest request) =>
{
    // Verify the bytes that arrived. If anything reads the body before this handler
    // ([FromBody] binding, a logging middleware), buffer it and rewind, or there is
    // nothing left to verify.
    request.EnableBuffering();
    using var copy = new MemoryStream();
    await request.Body.CopyToAsync(copy);
    request.Body.Position = 0;
    var rawBody = copy.ToArray();

    string? header = request.Headers["X-Revoply-Signature"];
    if (!RevoplySignature.Verify(rawBody, header, [secret]))
    {
        return Results.BadRequest();
    }

    using var envelope = JsonDocument.Parse(rawBody);
    var id = envelope.RootElement.GetProperty("id").GetString()!;
    var type = envelope.RootElement.GetProperty("type").GetString();
    var isTest = envelope.RootElement.GetProperty("test").GetBoolean();

    // The same event can arrive more than once: acknowledge a repeat and do nothing.
    if (!Handled.TryAdd(id, true))
    {
        return Results.Ok();
    }

    // Answer within 10 seconds; queue the real work instead of doing it here.
    Console.WriteLine($"{id} {type}{(isTest ? " (test)" : "")}");
    return Results.Ok();
});