Webhooks API

서명 페이로드 = "{timestamp}.{JSON body}"
기대값 = "sha256=" + HMAC-SHA256(secretKey, 서명 페이로드)
검증 = 기대값 == X-Webhook-Signature 헤더값 (sha256={hex} 형식)

const crypto = require('crypto');

function verifySignature(payload, signature, timestamp, secretKey) {
  const signPayload = `${timestamp}.${payload}`;
  const expectedHex = crypto
    .createHmac('sha256', secretKey)
    .update(signPayload)
    .digest('hex');
  const expected = `sha256=${expectedHex}`;
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

app.post('/webhooks/sweetbook', express.json(), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const timestamp = req.headers['x-webhook-timestamp'];
  const event = req.headers['x-webhook-event'];
  const payload = JSON.stringify(req.body);

  if (!verifySignature(payload, signature, timestamp, SECRET_KEY)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // 이벤트 처리
  switch (event) {
    case 'order.created':
      console.log('주문 생성 완료:', req.body);
      break;
    case 'shipping.departed':
      console.log('발송 완료:', req.body);
      break;
  }

  res.status(200).json({ received: true });
});

import hmac
import hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET_KEY = "whsk_your_secret_key"

def verify_signature(payload, signature, timestamp, secret_key):
    sign_payload = f"{timestamp}.{payload}"
    expected_hex = hmac.new(
        secret_key.encode(),
        sign_payload.encode(),
        hashlib.sha256
    ).hexdigest()
    expected = f"sha256={expected_hex}"
    return hmac.compare_digest(signature, expected)

@app.route('/webhooks/sweetbook', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Webhook-Signature')
    timestamp = request.headers.get('X-Webhook-Timestamp')
    event = request.headers.get('X-Webhook-Event')
    payload = request.get_data(as_text=True)

    if not verify_signature(payload, signature, timestamp, SECRET_KEY):
        return jsonify({"error": "Invalid signature"}), 401

    # 이벤트 처리
    data = request.get_json()
    if event == 'order.created':
        print(f"주문 생성 완료: {data}")
    elif event == 'shipping.departed':
        print(f"발송 완료: {data}")

    return jsonify({"received": True}), 200

{
  "success": true,
  "message": "Success",
  "data": {
    "deliveryUid": "wh_abc123xyz",
    "eventType": "order.created",
    "status": "SUCCESS",
    "responseStatus": 200,
    "responseBody": "{\"received\": true}"
  }
}