Verificar a assinatura do webhook (HMAC)

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.EMITRA_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 5 * 60;

function isValidSignature(rawBody, timestamp, signatureHeader) {
  if (!timestamp || !signatureHeader) return false;

  const ts = Number.parseInt(timestamp, 10);
  if (!Number.isFinite(ts)) return false;
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - ts) > TOLERANCE_SECONDS) return false;

  const expected =
    "sha256=" +
    crypto
      .createHmac("sha256", SECRET)
      .update(`${timestamp}.`)
      .update(rawBody)
      .digest("hex");

  const a = Buffer.from(expected, "utf8");
  const b = Buffer.from(signatureHeader, "utf8");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// express.raw mantém o corpo como Buffer, sem parse
app.post(
  "/webhooks/emitra",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const ok = isValidSignature(
      req.body,
      req.get("X-Emitra-Timestamp"),
      req.get("X-Emitra-Signature"),
    );
    if (!ok) return res.status(400).send("assinatura inválida");

    const event = JSON.parse(req.body.toString("utf8"));
    // Enfileire o processamento e responda rápido
    queue.add(event, { jobId: req.get("X-Emitra-Delivery") });
    res.status(200).send("ok");
  },
);

app.listen(3000);

import hashlib
import hmac
import json
import os
import time

from fastapi import FastAPI, Header, HTTPException, Request

app = FastAPI()
SECRET = os.environ["EMITRA_WEBHOOK_SECRET"].encode()
TOLERANCE_SECONDS = 5 * 60


def is_valid_signature(raw_body: bytes, timestamp: str | None, signature: str | None) -> bool:
    if not timestamp or not signature:
        return False
    try:
        ts = int(timestamp)
    except ValueError:
        return False
    if abs(time.time() - ts) > TOLERANCE_SECONDS:
        return False

    digest = hmac.new(SECRET, timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(f"sha256={digest}", signature)


@app.post("/webhooks/emitra")
async def receive(
    request: Request,
    x_portalnfse_timestamp: str | None = Header(default=None),
    x_portalnfse_signature: str | None = Header(default=None),
    x_portalnfse_delivery: str | None = Header(default=None),
):
    raw_body = await request.body()  # bytes, antes do parse
    if not is_valid_signature(raw_body, x_portalnfse_timestamp, x_portalnfse_signature):
        raise HTTPException(status_code=400, detail="assinatura inválida")

    event = json.loads(raw_body)
    enqueue(event, delivery_id=x_portalnfse_delivery)  # processe fora da request
    return {"ok": True}

<?php
$secret    = getenv('EMITRA_WEBHOOK_SECRET');
$tolerance = 5 * 60;

$rawBody   = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_PORTALNFSE_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_PORTALNFSE_SIGNATURE'] ?? '';
$delivery  = $_SERVER['HTTP_X_PORTALNFSE_DELIVERY'] ?? '';

function isValidSignature(string $raw, string $ts, string $sig, string $secret, int $tol): bool
{
    if ($ts === '' || $sig === '' || !ctype_digit($ts)) {
        return false;
    }
    if (abs(time() - (int) $ts) > $tol) {
        return false;
    }
    $expected = 'sha256=' . hash_hmac('sha256', $ts . '.' . $raw, $secret);
    return hash_equals($expected, $sig);
}

if (!isValidSignature($rawBody, $timestamp, $signature, $secret, $tolerance)) {
    http_response_code(400);
    exit('assinatura inválida');
}

$event = json_decode($rawBody, true);
// Grave na sua fila e responda rápido
enqueue($event, $delivery);

http_response_code(200);
echo 'ok';