Signa webhooks

const crypto = require('crypto');
const express = require('express');

const app = express();
const secret = process.env.BLAAIZ_WEBHOOK_SIGNING_SECRET;
const REPLAY_WINDOW_SECONDS = 300;

// Keep the raw body. The signature covers the exact bytes Blaaiz sent.
app.post('/webhooks/kyc', express.raw({ type: 'application/json' }), (req, res) => {
    const timestamp = req.headers['x-blaaiz-timestamp'];
    const receivedSignature = req.headers['x-blaaiz-signature'];

    if (!timestamp || !receivedSignature) {
        return res.status(400).send('Missing signature headers.');
    }

    const age = Math.floor(Date.now() / 1000) - Number(timestamp);
    if (!Number.isFinite(age) || Math.abs(age) > REPLAY_WINDOW_SECONDS) {
        return res.status(400).send('Timestamp outside the replay window.');
    }

    const expectedSignature = crypto
        .createHmac('sha256', secret)
        .update(`${timestamp}.${req.body.toString('utf8')}`)
        .digest('hex');

    const expected = Buffer.from(expectedSignature, 'utf8');
    const received = Buffer.from(receivedSignature, 'utf8');

    if (expected.length !== received.length || !crypto.timingSafeEqual(expected, received)) {
        return res.status(401).send('Invalid signature.');
    }

    const payload = JSON.parse(req.body.toString('utf8'));

    // Answer first, then process the event in the background.
    res.status(200).send('OK');

    if (payload.event === 'merchant.kyc.session.completed') {
        handleSessionResult(payload.data);
    }
});

<?php

$secret = getenv('BLAAIZ_WEBHOOK_SIGNING_SECRET');
$replayWindowSeconds = 300;

// The raw body, not a decoded and re-encoded copy.
$rawBody = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_BLAAIZ_TIMESTAMP'] ?? null;
$receivedSignature = $_SERVER['HTTP_X_BLAAIZ_SIGNATURE'] ?? null;

if ($timestamp === null || $receivedSignature === null) {
    http_response_code(400);
    exit('Missing signature headers.');
}

if (abs(time() - (int) $timestamp) > $replayWindowSeconds) {
    http_response_code(400);
    exit('Timestamp outside the replay window.');
}

$expectedSignature = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

if (! hash_equals($expectedSignature, $receivedSignature)) {
    http_response_code(401);
    exit('Invalid signature.');
}

$payload = json_decode($rawBody, true);

http_response_code(200);

if (($payload['event'] ?? null) === 'merchant.kyc.session.completed') {
    handleSessionResult($payload['data']);
}