Webhook Management

Copy

• Copy for LLM

  Copy page as Markdown for LLMs
• View as Markdown

  Open this page as Markdown
• Open in ChatGPT

  Get insights from ChatGPT
• Open in Claude

  Get insights from Claude

[HttpPost("ReceiveWebhook")]
public async Task<IActionResult> ReceiveWebhook()
{
     var requestBody = await new StreamReader(Request.Body).ReadToEndAsync();
 
     var theropaySignature = Request.Headers["X-Theropay-Signature"].FirstOrDefault();
     var theropayTimestamp = Request.Headers["X-Theropay-Timestamp"].FirstOrDefault();
 
     var partnerSecret = "OIviKHaZVXcHg9QB0j8Dzq/1bf4y7CgKmIu9iQktMJ4="; // Base64 from Theropay on webhook creation
 
     var isValid = VerifySignature(
         requestBody,
         theropaySignature,
         theropayTimestamp,
         partnerSecret);
 
     if (!isValid)
     {
         return Unauthorized("Invalid webhook signature.");
     }
 
     // Process webhook event
     var json = JsonSerializer.Deserialize<object>(requestBody);
 
     return Ok();
}
 
 
 
public static bool VerifySignature(string requestBody, string theropaySignatureHeader, string theropayTimestamp, string partnerSecretPlainText)
{
     // remove sha256=
     var expectedSignatureHex = theropaySignatureHeader.StartsWith("sha256=")
         ? theropaySignatureHeader.Substring(7)
         : theropaySignatureHeader;
 
     // DO NOT Base64 decode — match sender logic
     var secretBytes = Encoding.UTF8.GetBytes(partnerSecretPlainText);
 
     var signingString = $"{theropayTimestamp}.{requestBody}";
     var signingBytes = Encoding.UTF8.GetBytes(signingString);
 
     using var hmac = new HMACSHA256(secretBytes);
     var hash = hmac.ComputeHash(signingBytes);
 
     var computedHex = Convert.ToHexString(hash).ToLower();
 
     return SlowEquals(computedHex, expectedSignatureHex);
}
 
 
private static bool SlowEquals(string a, string b)
{
     // Constant-time comparison to avoid timing attacks
     var aBytes = Encoding.UTF8.GetBytes(a);
     var bBytes = Encoding.UTF8.GetBytes(b);
 
     if (aBytes.Length != bBytes.Length)
         return false;
 
     int diff = 0;
     for (int i = 0; i < aBytes.Length; i++)
         diff |= aBytes[i] ^ bBytes[i];
 
     return diff == 0;
}