Verify webhook signatures

import express, { Request, Response } from "express";
import { createHmac, timingSafeEqual } from "crypto";
import dotenv from "dotenv";

dotenv.config();
const app = express();

// Create a `POST` endpoint to accept webhooks sent by Paddle.
// We need `raw` request body to validate the integrity. Use express raw middleware to ensure express doesn't convert the request body to JSON.
app.post(
  "/webhooks",
  express.raw({ type: "application/json" }),
  async (req: Request, res: Response): Promise<any> => {
    try {
      // (Optional) Check if the request body is a buffer
      // This is to ensure that the request body is not converted to JSON by any middleware
      if (!Buffer.isBuffer(req.body)) {
        console.error("Request body is not a buffer");
        return res.status(500).json({ error: "Server misconfigured" });
      }

      // 1. Get Paddle-Signature header
      const paddleSignature = req.headers["paddle-signature"] as string;
      const secretKey = process.env.PADDLE_WEBHOOK_SECRET_KEY;

      // (Optional) Check if header and secret key are present and return error if not
      if (!paddleSignature) {
        console.error("Paddle-Signature not present in request headers");
        return res.status(400).json({ error: "Invalid request" });
      }

      if (!secretKey) {
        console.error("Secret key not defined");
        return res.status(500).json({ error: "Server misconfigured" });
      }

      // 2. Extract timestamp and signature from header
      if (!paddleSignature || !paddleSignature.includes(";")) {
        console.error("Invalid Paddle-Signature format");
        return res.status(400).json({ error: "Invalid request" });
      }

      const parts = paddleSignature.split(";");

      if (parts.length !== 2) {
        console.error("Invalid Paddle-Signature format");
        return res.status(400).json({ error: "Invalid request" });
      }

      const [timestampPart, signaturePart] = parts.map(
        (part) => part.split("=")[1],
      );

      if (!timestampPart || !signaturePart) {
        console.error(
          "Unable to extract timestamp or signature from Paddle-Signature header",
        );
        return res.status(400).json({ error: "Invalid request" });
      }

      const timestamp = timestampPart;
      const signature = signaturePart;

      // (Optional) Check timestamp against current time and reject if it's over 5 seconds old
      const timestampInt = parseInt(timestamp) * 1000;

      if (isNaN(timestampInt)) {
        console.error("Invalid timestamp format");
        return res.status(400).json({ error: "Invalid request" });
      }

      const currentTime = Date.now();

      if (currentTime - timestampInt > 5000) {
        console.error(
          "Webhook event expired (timestamp is over 5 seconds old):",
          timestampInt,
          currentTime,
        );
        return res.status(408).json({ error: "Event expired" });
      }

      // 3. Build signed payload
      const bodyRaw = req.body.toString(); // Converts from buffer to string
      const signedPayload = `${timestamp}:${bodyRaw}`;

      // 4. Hash signed payload using HMAC SHA256 and the secret key
      const hashedPayload = createHmac("sha256", secretKey)
        .update(signedPayload, "utf8")
        .digest("hex");

      // 5. Compare signatures
      if (
        !timingSafeEqual(Buffer.from(hashedPayload), Buffer.from(signature))
      ) {
        console.error("Computed signature does not match Paddle signature");
        return res.status(401).json({ error: "Invalid signature" });
      }

      // 6. Process the webhook event
      console.log("Webhook Data:", req.body); // Replace with own handling of webhook
      res.status(200).json({ success: true });
    } catch (error) {
      const errorMessage = (error as Error).message;
      console.error(
        "Failed to verify and process Paddle webhook",
        errorMessage,
      );
      res
        .status(500)
        .json({ error: "Failed to verify and process Paddle webhook" });
    }
  },
);

const PORT = process.env.PORT || 8080;
app.listen(PORT, () => {
  console.log(`Server is running on port ${PORT}`);
});

import { NextResponse } from "next/server";
import { createHmac, timingSafeEqual } from "crypto";

export async function POST(request: Request) {
  try {
    // 1. Get Paddle-Signature header
    const headers = request.headers;
    const paddleSignature = headers.get("paddle-signature");
    const secretKey = process.env.PADDLE_WEBHOOK_SECRET_KEY;

    // (Optional) Check if header and secret key are present and return error if not
    if (!paddleSignature) {
      console.error("Paddle-Signature not present in request headers");
      return NextResponse.json({ message: "Invalid request" }, { status: 400 });
    }

    if (!secretKey) {
      console.error("Secret key not defined");
      return NextResponse.json(
        { message: "Server misconfigured" },
        { status: 500 },
      );
    }

    // 2. Extract timestamp and signature from header
    if (!paddleSignature.includes(";")) {
      console.error("Invalid Paddle-Signature format");
      return NextResponse.json({ message: "Invalid request" }, { status: 400 });
    }

    const parts = paddleSignature.split(";");

    if (parts.length !== 2) {
      console.error("Invalid Paddle-Signature format");
      return NextResponse.json({ message: "Invalid request" }, { status: 400 });
    }

    const [timestampPart, signaturePart] = parts.map(
      (part) => part.split("=")[1],
    );

    if (!timestampPart || !signaturePart) {
      console.error(
        "Unable to extract timestamp or signature from Paddle-Signature header",
      );
      return NextResponse.json({ message: "Invalid request" }, { status: 400 });
    }

    const timestamp = timestampPart;
    const signature = signaturePart;

    // (Optional) Check timestamp against current time and reject if it's over 5 seconds old
    const timestampInt = parseInt(timestamp) * 1000; // Convert seconds to milliseconds

    if (isNaN(timestampInt)) {
      console.error("Invalid timestamp format");
      return NextResponse.json({ message: "Invalid request" }, { status: 400 });
    }

    const currentTime = Date.now();

    if (currentTime - timestampInt > 5000) {
      console.error(
        "Webhook event expired (timestamp is over 5 seconds old):",
        timestampInt,
        currentTime,
      );
      return NextResponse.json({ message: "Event expired" }, { status: 408 });
    }

    // 3. Build signed payload
    const bodyRaw = await request.text();
    const signedPayload = `${timestamp}:${bodyRaw}`;

    // 4. Hash signed payload using HMAC SHA256 and the secret key
    const hashedPayload = createHmac("sha256", secretKey)
      .update(signedPayload, "utf8")
      .digest("hex");

    // 5. Compare signatures
    if (!timingSafeEqual(Buffer.from(hashedPayload), Buffer.from(signature))) {
      console.error("Computed signature does not match Paddle signature");
      return NextResponse.json(
        { message: "Invalid signature" },
        { status: 401 },
      );
    }

    // 6. Process the webhook event
    const bodyJson = JSON.parse(bodyRaw);
    console.log("Webhook Data:", bodyJson); // Replace with own handling of webhook

    return NextResponse.json({ message: "Success" }, { status: 200 });
  } catch (error) {
    console.error(
      "Failed to verify and process Paddle webhook",
      (error as Error).message,
    );
    return NextResponse.json(
      { message: "Failed to verify and process Paddle webhook" },
      { status: 500 },
    );
  }
}

require 'sinatra'
require 'openssl'
require 'json'
require 'time'
require 'dotenv'

# Load environment variables
Dotenv.load

# This allows testing in development (i.e. with a tunnel solution) without having to specify a host
configure :development do
  set :host_authorization, { permitted_hosts: [] }
  puts "HostAuthorization protection disabled for development."
end

post '/webhooks' do
  begin
    # 1. Get Paddle-Signature header
    paddle_signature = request.env['HTTP_PADDLE_SIGNATURE']
    if paddle_signature.nil? || paddle_signature.empty?
      puts "Paddle-Signature not present in request headers"
      halt 400, { error: 'Invalid request' }.to_json
    end

    secret_key = ENV['PADDLE_WEBHOOK_SECRET_KEY']
    if secret_key.nil? || secret_key.empty?
      puts "Secret key not defined"
      halt 500, { error: 'Server misconfigured' }.to_json
    end

    # 2. Extract timestamp and signature from header
    parts = paddle_signature.split(';')
    if parts.length != 2
      puts "Invalid Paddle-Signature format"
      halt 400, { error: 'Invalid request' }.to_json
    end

    timestamp = parts[0].split('=')[1]
    signature = parts[1].split('=')[1]

    if timestamp.nil? || signature.nil?
      puts "Unable to extract timestamp or signature from Paddle-Signature header"
      halt 400, { error: 'Invalid request' }.to_json
    end

    # (Optional) Check timestamp against current time and reject if it's over 5 seconds old
    event_time = timestamp.to_i
    current_time = Time.now.to_i

    if current_time - event_time > 5
      puts "Webhook event expired (timestamp is over 5 seconds old): #{event_time}, #{current_time}"
      halt 408, { error: 'Event expired' }.to_json
    end

    request.body.rewind
    body_raw = request.body.read

    # 3. Build signed payload
    signed_payload = "#{timestamp}:#{body_raw}"

    # 4. Hash signed payload using HMAC SHA256 and the secret key
    computed_hash = OpenSSL::HMAC.hexdigest('SHA256', secret_key, signed_payload)

    # 5. Compare signatures
    unless Rack::Utils.secure_compare(computed_hash, signature)
      puts "Computed signature does not match Paddle signature"
      halt 401, { error: 'Invalid signature' }.to_json
    end

    # 6. Process the webhook event
    puts "Webhook Data: #{body_raw}" # Replace with own handling of webhook
    { success: true }.to_json
  rescue => e
    puts "Failed to verify and process Paddle webhook: #{e.message}"
    halt 500, { error: 'Failed to verify and process Paddle webhook' }.to_json
  end
end

# Start Sinatra server
port = ENV['PORT'] || 3000

set :port, port
puts "Server is running on port http://localhost:#{port}"

from flask import Flask, request, jsonify
import hashlib
import hmac
import time
import os
from dotenv import load_dotenv

# Load environment variables from .env file
load_dotenv()

app = Flask(__name__)

@app.route('/webhooks', methods=['POST'])
def handle_webhook():
    try:
        # 1. Get Paddle-Signature header
        paddle_signature = request.headers.get('Paddle-Signature')
        if not paddle_signature:
            print("Paddle-Signature not present in request headers")
            return jsonify({"error": "Invalid request"}), 400

        secret_key = os.getenv('PADDLE_WEBHOOK_SECRET_KEY')
        if not secret_key:
            print("Secret key not defined")
            return jsonify({"error": "Server misconfigured"}), 500

        # 2. Extract timestamp and signature from header
        signature_parts = paddle_signature.split(';')
        if len(signature_parts) != 2:
            print("Invalid Paddle-Signature format")
            return jsonify({"error": "Invalid request"}), 400

        timestamp = signature_parts[0].split('=')[1]
        signature = signature_parts[1].split('=')[1]

        if not timestamp or not signature:
            print("Unable to extract timestamp or signature from Paddle-Signature header")
            return jsonify({"error": "Invalid request"}), 400

        # (Optional) Check timestamp against current time and reject if it's over 5 seconds old
        event_time = int(timestamp)
        current_time = int(time.time())

        if current_time - event_time > 5:
            print("Webhook event expired (timestamp is over 5 seconds old):", event_time, current_time)
            return jsonify({"error": "Event expired"}), 408

        # We need `raw` request body to validate the integrity. Use as_text=True to ensure it's not converted to JSON.
        body_raw = request.get_data(as_text=True)

        # 3. Build signed payload
        signed_payload = f"{timestamp}:{body_raw}"

        # 4. Hash signed payload using HMAC SHA256 and the secret key
        computed_hash = hmac.new(secret_key.encode(), signed_payload.encode(), hashlib.sha256).hexdigest()

        # 5. Compare signatures
        if not hmac.compare_digest(computed_hash, signature):
            print("Computed signature does not match Paddle signature")
            return jsonify({"error": "Invalid signature"}), 401

        # 6. Process the webhook event
        print(f"Webhook Data: {body_raw}") # Replace with own handling of webhook
        return jsonify({"success": True})

    except Exception as e:
        print("Failed to verify and process Paddle webhook", str(e))
        return jsonify({"error": "Failed to verify and process Paddle webhook"}), 500


if __name__ == '__main__':
    app.run(debug=True, port=3000)

// WebhookController.java
// Replace 'your.package.name' with the actual package name
package your.package.name;

import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class WebhookController {

    private final WebhookHandler webhookHandler;

    public WebhookController(WebhookHandler webhookHandler) {
        this.webhookHandler = webhookHandler;
    }

    @PostMapping("/webhook")
    public ResponseEntity<Object> handleWebhook(
            @RequestBody String body, // Extract raw body from the request
            @RequestHeader("Paddle-Signature") String paddleSignature) { // Extract the signature from the header
        return webhookHandler.handleWebhook(body, paddleSignature); // Pass the signature and body to WebhookHandler
    }
}

// WebhookHandler.java
// Replace 'your.package.name' with the actual package name
package your.package.name;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.io.BufferedReader;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.Map;
import io.github.cdimascio.dotenv.Dotenv;
import org.springframework.stereotype.Service;
import java.util.logging.Logger;
import org.springframework.http.ResponseEntity;

@Service
public class WebhookHandler {

    private static final Logger logger = Logger.getLogger(WebhookHandler.class.getName());
    private final Dotenv dotenv;

    public WebhookHandler() {
        this.dotenv = Dotenv.load();
    }

    // Method to handle webhook verification and processing
    public ResponseEntity<Object> handleWebhook(String bodyRaw, String paddleSignature) {
        try {
            // 1. Verify Paddle-Signature header
            if (paddleSignature == null || paddleSignature.isEmpty()) {
                logger.severe("Paddle-Signature not present in request headers");
                return ResponseEntity.badRequest().body(new ErrorResponse("Invalid request"));
            }

            String secretKey = dotenv.get("PADDLE_WEBHOOK_SECRET_KEY");
            if (secretKey == null || secretKey.isEmpty()) {
                logger.severe("Secret key not defined");
                return ResponseEntity.status(500).body(new ErrorResponse("Server misconfigured"));
            }

            // 2. Extract timestamp and signature from header
            String[] signatureParts = paddleSignature.split(";");
            if (signatureParts.length != 2) {
                logger.severe("Invalid Paddle-Signature format");
                return ResponseEntity.badRequest().body(new ErrorResponse("Invalid request"));
            }

            String timestamp = null;
            String signature = null;

            for (String part : signatureParts) {
                String[] keyValue = part.split("=");
                if (keyValue.length != 2) {
                    logger.severe("Invalid Paddle-Signature part format");
                    return ResponseEntity.badRequest().body(new ErrorResponse("Invalid request"));
                }

                if ("ts".equals(keyValue[0])) {
                    timestamp = keyValue[1];
                } else if ("h1".equals(keyValue[0])) {
                    signature = keyValue[1];
                }
            }

            if (timestamp == null || signature == null) {
                logger.severe("Unable to extract timestamp or signature from Paddle-Signature header");
                return ResponseEntity.badRequest().body(new ErrorResponse("Invalid request"));
            }

            // (Optional) Check timestamp against current time and reject if it's over 5 seconds old
            long eventTime;
            try {
                eventTime = Long.parseLong(timestamp);
            } catch (NumberFormatException e) {
                logger.severe("Invalid timestamp format in Paddle-Signature header");
                return ResponseEntity.badRequest().body(new ErrorResponse("Invalid request"));
            }

            long currentTime = System.currentTimeMillis() / 1000;
            if (currentTime - eventTime > 5) {
                logger.severe("Webhook event expired: Event time is over 5 seconds old");
                return ResponseEntity.status(408).body(new ErrorResponse("Event expired"));
            }

            // 3. Build signed payload
            String signedPayload = timestamp + ":" + bodyRaw;

            // 4. Hash signed payload using HMAC SHA256 and the secret key
            String computedHash = computeHMACSHA256(signedPayload, secretKey);

            // 5. Compare signatures
            if (!timingSafeEquals(computedHash.getBytes(StandardCharsets.UTF_8), signature.getBytes(StandardCharsets.UTF_8))) {
                logger.severe("Computed signature does not match Paddle signature");
                return ResponseEntity.status(401).body(new ErrorResponse("Invalid signature"));
            }

            // 6. Process the webhook event
            logger.info("Webhook Data: " + bodyRaw);  // Replace with your own handling of the webhook
            return ResponseEntity.ok().body(new SuccessResponse("Webhook processed successfully"));

        } catch (Exception e) {
            logger.severe("Error processing webhook: " + e.getMessage());
            return ResponseEntity.status(500).body(new ErrorResponse("Failed to verify and process webhook"));
        }
    }

    private String computeHMACSHA256(String data, String key) throws Exception {
        try {
            Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKey = new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
            sha256_HMAC.init(secretKey);
            byte[] hash = sha256_HMAC.doFinal(data.getBytes(StandardCharsets.UTF_8));
            return bytesToHex(hash);
        } catch (NoSuchAlgorithmException e) {
            throw new Exception("HMAC SHA256 algorithm not available", e);
        }
    }

    private String bytesToHex(byte[] bytes) {
        StringBuilder hexString = new StringBuilder();
        for (byte b : bytes) {
            String hex = Integer.toHexString(0xff & b);
            if (hex.length() == 1) {
                hexString.append('0');
            }
            hexString.append(hex);
        }
        return hexString.toString();
    }

    private boolean timingSafeEquals(byte[] a, byte[] b) {
        if (a.length != b.length) {
            return false;
        }
        int result = 0;
        for (int i = 0; i < a.length; i++) {
            result |= a[i] ^ b[i];
        }
        return result == 0;
    }

    public static class ErrorResponse {
        private String error;

        public ErrorResponse(String error) {
            this.error = error;
        }

        public String getError() {
            return error;
        }
    }

    public static class SuccessResponse {
        private String message;

        public SuccessResponse(String message) {
            this.message = message;
        }

        public String getMessage() {
            return message;
        }
    }
}

using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;

[ApiController]
[Route("webhooks")]
public class PaddleWebhookController : ControllerBase
{
    private readonly ILogger<PaddleWebhookController> _logger;

    public PaddleWebhookController(ILogger<PaddleWebhookController> logger)
    {
        _logger = logger;
    }

    [HttpPost]
    public async Task<IActionResult> HandleWebhook()
    {
        try
        {
            Request.EnableBuffering();

            // 1. Get Paddle-Signature header
            if (!Request.Headers.TryGetValue("Paddle-Signature", out var paddleSignature) || string.IsNullOrEmpty(paddleSignature))
            {
                _logger.LogError("Paddle-Signature not present in request headers");
                return BadRequest(new { error = "Invalid request" });
            }

            var secretKey = Environment.GetEnvironmentVariable("PADDLE_WEBHOOK_SECRET_KEY");
            if (string.IsNullOrEmpty(secretKey))
            {
                _logger.LogError("Secret key not defined");
                return StatusCode(500, new { error = "Server misconfigured" });
            }

            // 2. Extract timestamp and signature from header
            var parts = paddleSignature.ToString().Split(";");
            if (parts.Length < 2)
            {
                _logger.LogError("Invalid Paddle-Signature format");
                return BadRequest(new { error = "Invalid request" });
            }

            var timestamp = parts[0].Split("=")[1];
            var signature = parts[1].Split("=")[1];

            // (Optional) Check timestamp against current time and reject if it's over 5 seconds old
            if (!long.TryParse(timestamp, out var timestampInt))
            {
                _logger.LogError("Invalid timestamp format");
                return BadRequest(new { error = "Invalid request" });
            }

            var currentTime = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds();
            var eventTime = timestampInt * 1000; // Convert seconds to milliseconds

            if (currentTime - eventTime > 5000)
            {
                _logger.LogError("Webhook event expired (timestamp is over 5 seconds old):");
                _logger.LogError("Event time: {0}", eventTime);
                _logger.LogError("Current time: {0}", currentTime);
                return StatusCode(408, new { error = "Event expired" });
            }

            // We need `raw` request body to validate the integrity. Use StreamReader to ensure the request body isn't converted to JSON.
            using var reader = new StreamReader(Request.Body, Encoding.UTF8);
            var bodyRaw = await reader.ReadToEndAsync();
            Request.Body.Position = 0;

            // 3. Build signed payload
            var signedPayload = $"{timestamp}:{bodyRaw}";

            // 4. Hash signed payload using HMAC SHA256 and the secret key
            using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secretKey));
            var computedHash = hmac.ComputeHash(Encoding.UTF8.GetBytes(signedPayload));
            var computedSignature = BitConverter.ToString(computedHash).Replace("-", "").ToLower();

            // 5. Compare signatures
            if (!CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(computedSignature), Encoding.UTF8.GetBytes(signature)))
            {
                _logger.LogError("Computed signature does not match Paddle signature");
                return Unauthorized(new { error = "Invalid signature" });
            }

            // 6. Process the webhook event
            _logger.LogInformation("Webhook Data: {0}", bodyRaw); // Replace with own handling of webhook
            return Ok(new { success = true });
        }
        catch (Exception ex)
        {
            _logger.LogError("Failed to verify and process Paddle webhook", ex.Message);
            return StatusCode(500, new { error = "Failed to verify and process webhook" });
        }
    }
}