Signature Verification

<?php

// 1. Terima payload
$payload = json_decode(
    file_get_contents('php://input'),
    true
);

// 2. Ambil signature dari header
$receivedSignature = 
    $_SERVER['HTTP_X_SIGNATURE'] ?? '';

// 3. Buat expected signature
$webhookSecret = env('WEBHOOK_SECRET');
$event = $payload['event'] ?? '';

// status untuk signature tergantung event
$statusForSignature = match ($event) {
    'order.item.sent' => 'item.sent',
    'webhook.test' => 'test',
    default => $payload['data']['status'] ?? '',
};

$expectedSignature = hash('sha256', 
    sprintf(
        '%s:%s:%s:%s',
        $payload['data']['ref_id'] ?? '',
        $payload['data']['invoice'] ?? '',
        $statusForSignature,
        $webhookSecret
    )
);

// 4. Verifikasi (timing-safe)
if (!hash_equals(
    $expectedSignature, 
    $receivedSignature
)) {
    http_response_code(401);
    echo json_encode([
        'error' => 'Invalid signature'
    ]);
    exit;
}

// 5. Signature valid! Proses data
$data = $payload['data'];

switch ($event) {
    case 'order.completed':
        // Update status order
        // Kirim notifikasi customer
        break;
    
    case 'order.canceled':
        // Handle canceled
        break;

    case 'order.item.sent':
        // Handle delivery item manual secara real-time
        break;
}

http_response_code(200);
echo json_encode(['status' => 'ok']);

const crypto = require('crypto');

app.post('/webhook', (req, res) => {
    const payload = req.body;
    const receivedSig = 
        req.headers['x-signature'];
    
    const webhookSecret = 
        process.env.WEBHOOK_SECRET;
    const event = payload.event || '';
    
    // status untuk signature tergantung event
    const statusForSignature =
        event === 'order.item.sent' ? 'item.sent'
        : event === 'webhook.test' ? 'test'
        : (payload.data?.status || '');
    
    // Buat expected signature
    const sigPayload = [
        payload.data.ref_id || '',
        payload.data.invoice || '',
        statusForSignature,
        webhookSecret
    ].join(':');
    
    const expectedSig = crypto
        .createHash('sha256')
        .update(sigPayload)
        .digest('hex');
    
    // Verifikasi (timing-safe)
    try {
        if (!crypto.timingSafeEqual(
            Buffer.from(expectedSig),
            Buffer.from(receivedSig)
        )) {
            return res
                .status(401)
                .json({ error: 'Invalid' });
        }
    } catch {
        return res
            .status(401)
            .json({ error: 'Invalid' });
    }
    
    // Valid! Proses
    const { event, data } = payload;
    console.log(`Received: ${event}`);
    
    res.json({ status: 'ok' });
});