Webhooks

{
  "id": "evt_1a2b3c4d5e6f",
  "type": "alert.created",
  "created_at": "2024-01-15T10:30:00Z",
  "data": {
    "alert": {
      "id": "alt_abc123",
      "type": "dmarc_failure_spike",
      "severity": "high",
      "domain_id": "dom_xyz789",
      "domain_name": "example.com",
      "title": "DMARC Failure Spike Detected",
      "description": "DMARC failure rate increased from 2% to 15% in the last 24 hours",
      "created_at": "2024-01-15T10:30:00Z",
      "metadata": {
        "failure_rate": 15.2,
        "previous_rate": 2.1,
        "affected_sources": ["192.168.1.100", "10.0.0.50"]
      }
    }
  }
}

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const timestamp = signature.split(',')[0].split('=')[1];
  const receivedSignature = signature.split(',')[1].split('=')[1];

  // Verify timestamp is within 5 minutes to prevent replay attacks
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - parseInt(timestamp)) > 300) {
    throw new Error('Webhook timestamp is too old');
  }

  // Create the signed payload
  const signedPayload = `${timestamp}.${payload}`;

  // Calculate the expected signature
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Use timing-safe comparison
  const isValid = crypto.timingSafeEqual(
    Buffer.from(receivedSignature),
    Buffer.from(expectedSignature)
  );

  if (!isValid) {
    throw new Error('Invalid webhook signature');
  }

  return true;
}

// Express.js example
app.post('/webhooks/mimeprotect', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-mimeprotect-signature'];
  const payload = req.body.toString();

  try {
    verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET);

    const event = JSON.parse(payload);

    // Handle the webhook event
    switch (event.type) {
      case 'alert.created':
        handleNewAlert(event.data.alert);
        break;
      case 'report.received':
        handleNewReport(event.data.report);
        break;
      // ... handle other events
    }

    res.status(200).send('OK');
  } catch (error) {
    console.error('Webhook error:', error.message);
    res.status(400).send('Invalid signature');
  }
});