Webhook Delivery

import express from "express";
import { createPublicKey, verify as verifySignature } from "node:crypto";

const signingKeyResponse = await fetch("https://api.anyway.sh/v1/webhooks/signing-key");
if (!signingKeyResponse.ok) throw new Error("Unable to load Anyway signing keys");
const jwks = await signingKeyResponse.json();
const verificationKeys = jwks.keys.map((jwk) =>
  createPublicKey({ key: jwk, format: "jwk" }),
);

function verifyAnywayWebhook(rawBody, headers) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatureHeader = headers["webhook-signature"];
  if (!id || !timestamp || !signatureHeader) throw new Error("Missing webhook headers");

  const timestampSeconds = Number(timestamp);
  if (!Number.isSafeInteger(timestampSeconds) ||
      Math.abs(Math.floor(Date.now() / 1000) - timestampSeconds) > 300) {
    throw new Error("Stale webhook timestamp");
  }

  const signedContent = Buffer.concat([
    Buffer.from(`${id}.${timestamp}.`, "utf8"),
    rawBody,
  ]);
  const valid = signatureHeader.split(" ").some((versionedSignature) => {
    const [version, encodedSignature] = versionedSignature.split(",", 2);
    if (version !== "v1a" || !encodedSignature) return false;
    try {
      const signature = Buffer.from(encodedSignature, "base64");
      return verificationKeys.some((key) =>
        verifySignature(null, signedContent, key, signature),
      );
    } catch {
      return false;
    }
  });
  if (!valid) throw new Error("Invalid webhook signature");
  return JSON.parse(rawBody.toString("utf8"));
}

const app = express();

app.post("/webhooks/anyway", express.raw({ type: "application/json" }), (req, res) => {
  let event;
  try {
    event = verifyAnywayWebhook(req.body, {
      "webhook-id": req.header("webhook-id"),
      "webhook-timestamp": req.header("webhook-timestamp"),
      "webhook-signature": req.header("webhook-signature"),
    });
  } catch {
    return res.sendStatus(401);
  }

  enqueueIdempotently(req.header("webhook-id"), event);
  return res.sendStatus(204);
});

# pip install cryptography
import base64
import json
import time
from urllib.request import urlopen

from cryptography.exceptions import InvalidSignature
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

def decode_base64url(value):
    return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))

with urlopen("https://api.anyway.sh/v1/webhooks/signing-key", timeout=5) as response:
    jwks = json.load(response)

verification_keys = [
    Ed25519PublicKey.from_public_bytes(decode_base64url(jwk["x"]))
    for jwk in jwks["keys"]
]

def verify_anyway_webhook(raw_body, headers):
    webhook_id = headers.get("webhook-id")
    timestamp = headers.get("webhook-timestamp")
    signature_header = headers.get("webhook-signature")
    if not webhook_id or not timestamp or not signature_header:
        raise ValueError("Missing webhook headers")

    timestamp_seconds = int(timestamp)
    if abs(int(time.time()) - timestamp_seconds) > 300:
        raise ValueError("Stale webhook timestamp")

    signed_content = f"{webhook_id}.{timestamp}.".encode() + raw_body
    for versioned_signature in signature_header.split():
        try:
            version, encoded_signature = versioned_signature.split(",", 1)
            if version != "v1a":
                continue
            signature = base64.b64decode(encoded_signature, validate=True)
            for key in verification_keys:
                try:
                    key.verify(signature, signed_content)
                    return json.loads(raw_body)
                except InvalidSignature:
                    pass
        except (ValueError, TypeError):
            continue
    raise InvalidSignature("Invalid webhook signature")


@app.post("/webhooks/anyway")
def anyway_webhook():
    try:
        event = verify_anyway_webhook(request.get_data(), request.headers)
    except (InvalidSignature, ValueError):
        return ("", 401)

    enqueue_idempotently(request.headers["webhook-id"], event)
    return ("", 204)