Webhook payloads

import crypto from 'node:crypto';
import express from 'express';

const SECRET = process.env.TRADION_SIGNING_SECRET; // '<your signing secret>'
const app = express();

// express.raw gives you the untouched bytes — required for the digest to match.
app.post('/tradion', express.raw({ type: 'application/json' }), (req, res) => {
  const received = req.get('X-Tradion-Signature') || '';
  const expected =
    'sha256=' + crypto.createHmac('sha256', SECRET).update(req.body).digest('hex');

  const a = Buffer.from(received);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('bad signature');
  }

  const payload = JSON.parse(req.body.toString('utf8'));
  res.status(200).send('ok');       // acknowledge first
  handleAsync(payload);             // then do the slow work
});

app.listen(8080);

import hmac
import hashlib
import os
from flask import Flask, request, abort

SECRET = os.environ["TRADION_SIGNING_SECRET"].encode()  # "<your signing secret>"
app = Flask(__name__)

@app.post("/tradion")
def tradion():
    body = request.get_data()                       # raw bytes, not request.json
    received = request.headers.get("X-Tradion-Signature", "")
    expected = "sha256=" + hmac.new(SECRET, body, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(received, expected):
        abort(401)

    payload = request.get_json()
    enqueue(payload)                                # do slow work off the request
    return "", 200

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"net/http"
	"os"
)

var secret = []byte(os.Getenv("TRADION_SIGNING_SECRET")) // "<your signing secret>"

func tradion(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(r.Body) // raw bytes
	if err != nil {
		http.Error(w, "read error", http.StatusBadRequest)
		return
	}

	mac := hmac.New(sha256.New, secret)
	mac.Write(body)
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))

	if !hmac.Equal([]byte(r.Header.Get("X-Tradion-Signature")), []byte(expected)) {
		http.Error(w, "bad signature", http.StatusUnauthorized)
		return
	}

	var payload map[string]any
	if err := json.Unmarshal(body, &payload); err != nil {
		http.Error(w, "bad json", http.StatusBadRequest)
		return
	}

	w.WriteHeader(http.StatusOK)
	go handleAsync(payload)
}

func main() {
	http.HandleFunc("/tradion", tradion)
	http.ListenAndServe(":8080", nil)
}