Sécurité des Pulses

const crypto = require('crypto');

app.post('/webhooks/chariow',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const received = req.header('x-chariow-signature') ?? '';
    const expected = 'sha256=' + crypto
      .createHmac('sha256', process.env.CHARIOW_PULSE_SECRET)
      .update(req.body)                 // Buffer brut, jamais un objet re-sérialisé
      .digest('hex');

    const a = Buffer.from(received);
    const b = Buffer.from(expected);

    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).send('Invalid signature');
    }

    const deliveryId = req.header('x-pulse-delivery-id');

    if (alreadyProcessed(deliveryId)) {
      return res.status(200).send('OK');
    }

    res.status(200).send('OK');
    enqueue(deliveryId, JSON.parse(req.body.toString('utf8')));
  }
);

<?php

$raw = file_get_contents('php://input');
$received = $_SERVER['HTTP_X_CHARIOW_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $raw, getenv('CHARIOW_PULSE_SECRET'));

if (! hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}

$deliveryId = $_SERVER['HTTP_X_PULSE_DELIVERY_ID'] ?? null;

if (already_processed($deliveryId)) {
    http_response_code(200);
    exit;
}

$payload = json_decode($raw, true);

import hmac, hashlib, os

@app.post('/webhooks/chariow')
def chariow_webhook():
    raw = request.get_data()  # octets bruts, pas request.json
    expected = 'sha256=' + hmac.new(
        os.environ['CHARIOW_PULSE_SECRET'].encode(),
        raw,
        hashlib.sha256,
    ).hexdigest()

    received = request.headers.get('X-Chariow-Signature', '')

    if not hmac.compare_digest(expected, received):
        return '', 401

    delivery_id = request.headers.get('X-Pulse-Delivery-Id')

    if already_processed(delivery_id):
        return '', 200

    enqueue(delivery_id, request.get_json())

    return '', 200