Verify and Validate an Event Notification

# server.py

from http.server import BaseHTTPRequestHandler, HTTPServer
from square.utilities.webhooks_helper import is_valid_webhook_event_signature

# The URL where event notifications are sent.
NOTIFICATION_URL = 'https://example.com/webhook'

# The signature key defined for the subscription.
SIGNATURE_KEY = 'asdf1234'

class MainHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        length = int(self.headers.get('content-length', 0))
        body = self.rfile.read(length).decode('utf-8')
        square_signature = self.headers.get('x-square-hmacsha256-signature')

        # Generate a signature from the notification url, signature key,
        # and request body and compare it to the Square signature header.
        is_from_square = is_valid_webhook_event_signature(body,
                                                          square_signature,
                                                          SIGNATURE_KEY,
                                                          NOTIFICATION_URL)

        if is_from_square:
            # Signature is valid. Return 200 OK.
            self.send_response(200)
            print("Request body: {}".format(body))
        else:
            # Signature is invalid. Return 403 Forbidden.
            self.send_response(403)

        self.end_headers()

# Start a simple server for local testing.
# Different frameworks may provide the raw request body in other ways.
# INSTRUCTIONS
# After installing the SDK:
# 1. Run the server:
#    python server.py
# 2. Send the following request from a separate terminal:
#    curl -vX POST localhost:8000 -d '{"hello":"world"}' -H "X-Square-HmacSha256-Signature: 2kRE5qRU2tR+tBGlDwMEw2avJ7QM4ikPYD/PJ3bd9Og="
server = HTTPServer(("0.0.0.0", 8000), MainHandler)
server.serve_forever()

using Square.Utilities;
using System.IO;
using System.Net;
using System.Text;
using System.Threading.Tasks;

public class Server
{
    /// <summary>The URL where event notifications are sent.</summary>
    private const string NOTIFICATION_URL = "https://example.com/webhook";

    /// <summary>The signature key defined for the subscription.</summary>
    private const string SIGNATURE_KEY = "asdf1234";

    /// <summary>
    /// Generate a signature from the notification url, signature key,
    /// and request body and compare it to the Square signature header. 
    /// </summary>
    private static async Task<bool> IsFromSquare(HttpListenerRequest request)
    {
        using (var reader = new StreamReader(request.InputStream, Encoding.UTF8))
        {
            var signature = request.Headers.Get("x-square-hmacsha256-signature") ?? "";
            var requestBody = await reader.ReadToEndAsync();
            return WebhooksHelper.IsValidWebhookEventSignature(requestBody, signature, SIGNATURE_KEY, NOTIFICATION_URL);
        }
    }

    /// <summary>
    /// Start a simple server for local testing. Different frameworks may provide the raw request body in other ways.
    /// </summary>
    /// <remarks>
    /// INSTRUCTIONS
    /// After installing the SDK:
    /// 1. Run the server:
    ///    (You will first need to include your own csharp.csproj file.)
    ///    <code>dotnet run</code>
    /// 2. Send the following request from a separate terminal:
    ///    <code>curl -vX POST localhost:8000 -d '{"hello":"world"}' -H "X-Square-HmacSha256-Signature: 2kRE5qRU2tR+tBGlDwMEw2avJ7QM4ikPYD/PJ3bd9Og="</code>
    /// </remarks>
    public static void Main(string[] args)
    {
        HttpListener server = new HttpListener();
        server.Prefixes.Add("http://localhost:8000/");
        server.Start();

        while (true)
        {
            HttpListenerContext context = server.GetContext();

            var task = IsFromSquare(context.Request);
            task.Wait();
            bool isFromSquare = task.Result;

            using (HttpListenerResponse response = context.Response)
            {
                if (isFromSquare)
                {
                    // Signature is valid. Return 200 OK.
                    response.StatusCode = 200;
                }
                else
                {
                    // Signature is invalid. Return 403 Forbidden.
                    response.StatusCode = 403;
                }
            }
         }
      }
   }
}

// server.go

package main

import (
    "context"
    "fmt"
    "io/ioutil"
    "net/http"
    "os"

    "github.com/square/square-go-sdk"
    squareclient "github.com/square/square-go-sdk/client"
)

// The URL where event notifications are sent.
// The signature key defined for the subscription.
const (
    NOTIFICATION_URL = "https://example.com/webhook"
    SIGNATURE_KEY    = "asdf1234"
)

// Generate a signature from the notification url, signature key,
// and request body and compare it to the Square signature header.
func isFromSquare(signature string, body []byte) bool {
    client := squareclient.NewClient()

    err := client.Webhooks.VerifySignature(
        context.TODO(),
        &square.VerifySignatureRequest{
            RequestBody:     string(body),
            SignatureHeader: signature,
            SignatureKey:    SIGNATURE_KEY,
            NotificationURL: NOTIFICATION_URL,
        },
    );
    return err == nil
}

func requestHandler(w http.ResponseWriter, r *http.Request) {
    signature := r.Header.Get("X-Square-HmacSha256-Signature")
    body, err := ioutil.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Failed to read request body", http.StatusInternalServerError)
        return
    }

    if isFromSquare(signature, body) {
        // Signature is valid. Return 200 OK.
        w.WriteHeader(http.StatusOK)
        fmt.Fprintf(w, "Request body: %s\n", body)
    } else {
        // Signature is invalid. Return 403 Forbidden.
        w.WriteHeader(http.StatusForbidden)
        fmt.Fprintln(w, "Invalid signature")
    }
}

// Start a simple server for local testing.
// Different frameworks may provide the raw request body in other ways.
// INSTRUCTIONS
// After initializing a new Go module and installing the SDK:
// 1. Run the server:
//    go run server.go
// 2. Send the following request from a separate terminal:
//    curl -vX POST localhost:8000 -d '{"hello":"world"}' -H "X-Square-HmacSha256-Signature: 2kRE5qRU2tR+tBGlDwMEw2avJ7QM4ikPYD/PJ3bd9Og="
func main() {
    http.HandleFunc("/", requestHandler)
    port := "8000"
    fmt.Printf("Server is listening on port %s\n", port)
    if err := http.ListenAndServe(":"+port, nil); err != nil {
        fmt.Fprintf(os.Stderr, "Failed to start server: %v\n", err)
        os.Exit(1)
    }
}

# server.rb

require 'base64'
require 'openssl'
require 'sinatra'

require 'square'

# The URL where event notifications are sent.
NOTIFICATION_URL = "https://example.com/webhook"

# The signature key defined for the subscription.
SIGNATURE_KEY = "asdf1234"

# Generate a signature from the notification url, signature key,
# and request body and compare it to the Square signature header. 
def is_from_square(signature, body)
  return Square::WebhooksHelper.is_valid_webhook_event_signature(body, signature, SIGNATURE_KEY, NOTIFICATION_URL)
end

# Start a simple server for local testing.
# Different frameworks may provide the raw request body in other ways.
# INSTRUCTIONS
# After installing the SDK:
# 1. Run the server:
#    (You may need to `gem install sinatra` first.)
#    ruby server.rb
# 2. Send the following request from a separate terminal:
#    curl -vX POST localhost:8000 -d '{"hello":"world"}' -H "X-Square-HmacSha256-Signature: 2kRE5qRU2tR+tBGlDwMEw2avJ7QM4ikPYD/PJ3bd9Og="
set :port, 8000
post '/' do
  signature = request.env['HTTP_X_SQUARE_HMACSHA256_SIGNATURE']
  body = request.body.read
  if is_from_square(signature, body)
    # Signature is valid. Return 200 OK.
    status 200
    puts "Request body: %s" % body
  else
    # Signature invalid valid. Return 403 Forbidden.
    status 403
  end
end