Webhooks

use Illuminate\Http\Request;

Route::post('/webhooks/lekalao', function (Request $request) {
    $expected = hash_hmac('sha256', $request->getContent(), config('services.lekalao.webhook_secret'));

    abort_unless(hash_equals($expected, (string) $request->header('X-Lekalao-Signature')), 401);

    match ($request->input('event')) {
        'subscriber.unsubscribed' => Customer::where('email', $request->input('data.email'))
            ->update(['newsletter' => false]),
        default => null,
    };

    return response()->noContent();
});

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post(
    '/webhooks/lekalao',
    express.raw({ type: 'application/json' }),
    (req, res) => {
        const expected = crypto
            .createHmac('sha256', process.env.LEKALAO_WEBHOOK_SECRET)
            .update(req.body)
            .digest('hex');
        const received = req.get('X-Lekalao-Signature') ?? '';

        const valid =
            received.length === expected.length &&
            crypto.timingSafeEqual(
                Buffer.from(received),
                Buffer.from(expected),
            );

        if (!valid) return res.sendStatus(401);

        const { event, data } = JSON.parse(req.body);
        // …
        res.sendStatus(204);
    },
);

import hashlib
import hmac
import os

from flask import Flask, abort, request

app = Flask(__name__)

@app.post("/webhooks/lekalao")
def lekalao():
    expected = hmac.new(
        os.environ["LEKALAO_WEBHOOK_SECRET"].encode(),
        request.get_data(),
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, request.headers.get("X-Lekalao-Signature", "")):
        abort(401)

    payload = request.get_json()
    # …
    return "", 204