Webhook imzası nasıl doğrulanır? PHP, Node.js ve Python örnekleri

webhook-id: 01jab3t6y8q7z0k5w9x2c4d6ef
webhook-timestamp: 1760778902
webhook-signature: v1,bkasCZjmHFOH+EYlzJiVUXX0aoEvGPmlqK69s6np8Ss=

imzalanan içerik = webhook-id + "." + webhook-timestamp + "." + ham gövde baytları
imza             = base64( HMAC-SHA256( anahtar = base64decode("whsec_" öneki olmadan sır), imzalanan içerik ) )

<?php
function uppu_verify_webhook(array $secrets, string $id, string $timestamp, string $body, string $signatureHeader, int $tolerance = 300): bool
{
    if ($id === '' || !ctype_digit($timestamp) || abs(time() - (int) $timestamp) > $tolerance) {
        return false;
    }
    $signed = $id . '.' . $timestamp . '.' . $body;
    foreach ($secrets as $secret) {
        if (!is_string($secret) || strncmp($secret, 'whsec_', 6) !== 0) {
            continue;
        }
        $key = base64_decode(substr($secret, 6), true);          // metin değil, ham baytlar
        if ($key === false || $key === '') {
            continue;
        }
        $expected = base64_encode(hash_hmac('sha256', $signed, $key, true));
        foreach (explode(' ', $signatureHeader) as $part) {
            [$version, $signature] = array_pad(explode(',', $part, 2), 2, '');
            if ($version === 'v1' && hash_equals($expected, $signature)) {
                return true;
            }
        }
    }
    return false;
}

$body = file_get_contents('php://input');                        // ham gövde, değiştirmeden
$h = array_change_key_case(getallheaders(), CASE_LOWER);
$secrets = array_filter([getenv('UPPU_WEBHOOK_SECRET') ?: '', getenv('UPPU_WEBHOOK_SECRET_OLD') ?: '']);
if (!uppu_verify_webhook($secrets, $h['webhook-id'] ?? '', $h['webhook-timestamp'] ?? '', (string) $body, $h['webhook-signature'] ?? '')) {
    http_response_code(401);                                     // etkinleştirme denemesi burada 2xx dışı yanıt bekler
    exit;
}
$event = json_decode($body, true, 512, JSON_THROW_ON_ERROR);
// 1) $event['id'] ile tekrarları ayıklayın  2) işi kuyruğa alın  3) hızlı yanıt verin
http_response_code(204);

import { createServer } from 'node:http';
import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyUppuWebhook(secrets, id, timestamp, rawBody, signatureHeader, toleranceSec = 300) {
  if (!id || !/^[0-9]+$/.test(timestamp ?? '')) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSec) return false;
  const signed = Buffer.concat([Buffer.from(`${id}.${timestamp}.`, 'utf8'), rawBody]);
  const given = (signatureHeader ?? '').split(' ').flatMap((part) => {
    const comma = part.indexOf(',');
    return comma > 0 && part.slice(0, comma) === 'v1' ? [Buffer.from(part.slice(comma + 1), 'utf8')] : [];
  });
  for (const secret of secrets) {
    if (typeof secret !== 'string' || !secret.startsWith('whsec_')) continue;
    const key = Buffer.from(secret.slice(6), 'base64');
    if (key.length === 0) continue;
    const expected = Buffer.from(createHmac('sha256', key).update(signed).digest('base64'), 'utf8');
    if (given.some((sig) => sig.length === expected.length && timingSafeEqual(sig, expected))) return true;
  }
  return false;
}

createServer((req, res) => {
  const chunks = [];
  req.on('data', (chunk) => chunks.push(chunk));
  req.on('end', () => {
    const raw = Buffer.concat(chunks);                            // ham baytlar; yeniden serileştirmeyin
    const ok = verifyUppuWebhook([process.env.UPPU_WEBHOOK_SECRET], req.headers['webhook-id'],
      req.headers['webhook-timestamp'], raw, req.headers['webhook-signature']);
    if (!ok) { res.writeHead(401).end(); return; }
    const event = JSON.parse(raw.toString('utf8'));
    // event.id ile tekrarları ayıklayın, işi kuyruğa alın, sonra:
    res.writeHead(204).end();
  });
}).listen(8080);

import base64
import hashlib
import hmac
import re
import time


def verify_uppu_webhook(secrets, msg_id, timestamp, raw_body, signature_header, tolerance=300, now=None):
    if not msg_id or not timestamp or not re.fullmatch(r"[0-9]+", timestamp):
        return False
    if abs((time.time() if now is None else now) - int(timestamp)) > tolerance:
        return False
    signed = f"{msg_id}.{timestamp}.".encode("utf-8") + raw_body
    given = []
    for part in (signature_header or "").split(" "):
        version, _, signature = part.partition(",")
        if version == "v1" and signature:
            given.append(signature.encode("utf-8"))
    for secret in secrets:
        if not secret or not secret.startswith("whsec_"):
            continue
        key = base64.b64decode(secret[len("whsec_"):])
        expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest())
        if any(hmac.compare_digest(expected, signature) for signature in given):
            return True
    return False

import json
import os

from flask import Flask, request

app = Flask(__name__)


@app.post("/uppu/webhook")
def uppu_webhook():
    raw = request.get_data()  # ham baytlar, JSON ayrıştırılmadan önce
    ok = verify_uppu_webhook(
        [os.environ["UPPU_WEBHOOK_SECRET"], os.environ.get("UPPU_WEBHOOK_SECRET_OLD", "")],
        request.headers.get("webhook-id", ""),
        request.headers.get("webhook-timestamp", ""),
        raw,
        request.headers.get("webhook-signature", ""),
    )
    if not ok:
        return "", 401
    event = json.loads(raw)
    # event["id"] ile tekrarları ayıklayın, işi kuyruğa alın, hızlı yanıt verin
    return "", 204

SECRET = "whsec_dXBwdS1leGFtcGxlLXNpZ25pbmcta2V5LTMyYnl0ZXM="
BODY = ('{"id":"01jab3t6y8q7z0k5w9x2c4d6ef","object":"event","type":"webhook.test","api_version":"v1",'
        '"created_at":"2026-10-18T09:15:02.481Z","team_id":"01j8x7tm5k2m4n6p8q0r2s4t6v","channel":null,'
        '"test":true,"data":{"note":"UPPU test olayı","endpoint_id":"01jab3ep5k2m4n6p8q0r2s4t6v"}}').encode("utf-8")

print(verify_uppu_webhook([SECRET], "01jab3t6y8q7z0k5w9x2c4d6ef", "1760778902", BODY,
                          "v1,bkasCZjmHFOH+EYlzJiVUXX0aoEvGPmlqK69s6np8Ss=", now=1760778902))   # True
print(verify_uppu_webhook([SECRET], "01jab3t6y8q7z0k5w9x2c4d6ef", "1760778902", BODY + b" ",
                          "v1,bkasCZjmHFOH+EYlzJiVUXX0aoEvGPmlqK69s6np8Ss=", now=1760778902))   # False