Webhooks

import crypto from 'crypto';

app.post('/formo-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const secret = process.env.FORMO_WEBHOOK_SECRET;
  const timestamp = req.header('X-Webhook-Timestamp');
  const signature = req.header('X-Webhook-Signature');
  const rawBody = req.body.toString('utf8');

  // Reject stale replays (timestamp is inside the signed material).
  if (!timestamp || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(401).end();
  }

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  // Constant-time compare. A plain === leaks the signature byte by byte.
  const a = Buffer.from(signature ?? '', 'hex');
  const b = Buffer.from(expected, 'hex');
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).end();
  }

  const payload = JSON.parse(rawBody); // safe to trust now
  // handle the submission
  res.status(200).end();
});

import hmac, hashlib, time

def verify(raw_body: bytes, timestamp: str, signature: str, secret: str) -> bool:
    if not timestamp or abs(time.time() - int(timestamp)) > 300:
        return False
    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.".encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature or "")