Webhook security

## Split the x-livestorm-signature on the "," (comma) character.
payload_timestamp = '' # first part of the livestorm header
payload_signature = '' # second part of the livestorm header, the hash

acceptable_age = 5 # the tolerance to the age of the request

hash = Digest::SHA256.new
hash.update(timestamp)
hash.update(secret_key)
hash.update(payload)
my_signature = hash.hexdigest

# or, in a shorter way
my_signature = Digest::SHA256.hexdigest("#{timestamp}#{secret_key}#{payload}")

## then compare your signature to the one in the headers

if my_signature != payload_signature || Time.now().to_i - payload_timestamp > acceptable_age 
  # stop the process
end

<?php
// Split the x-livestorm-signature on the "," (comma) character.
$payloadSignature = ''; // first part of the livestorm header
$payloadTimestamp = ''; // second part of the livestorm header, the hash

$acceptableAge = 5; // the tolerance to the age of the request
  
$mySignature = hash('sha256', $timestamp . $secret . $payload);

if ($payloadSignature != $mySignature || time() - $payloadTimestamp > $acceptableAge) {
  //stop the process
} 

const { createHash } = require('crypto');

// Split the x-livestorm-signature on the "," (comma) character.
const payloadSignature = ''; // first part of the livestorm header
const payloadTimestamp = ''; // second part of the livestorm header, the hash

const acceptableAge = 5; //the tolerance to the age of the request

const mySignature = createHash('sha256').update(timestamp + secret + payload).digest('hex');

if (payloadSignature != mySignature || (Date.now() / 1000) - payloadTimestamp > acceptableAge) {
  //stop the process
} 

#!/usr/bin/env ruby

require "webrick"
require "digest"

# To install the dependency:
# $ gem install webrick

SECRET_KEY = "my_secret_key"

class MyServlet < WEBrick::HTTPServlet::AbstractServlet
    def do_POST (request, response)
        # read timesamp and signature from "x-livestorm-signature" header
        signature_header = request.header["x-livestorm-signature"].first
        timestamp, signature = signature_header.split(",")

        # read payload form the request body
        payload = request.body

        # either sign this way
        hash = Digest::SHA256.new
        hash.update(timestamp)
        hash.update(SECRET_KEY)
        hash.update(payload)
        my_signature1 = hash.hexdigest
        
        # or or this one (shorter ^^)
        my_signature2 = Digest::SHA256.hexdigest("#{timestamp}#{SECRET_KEY}#{payload}")

        puts "---"
        puts "My 1st signature: #{my_signature1}"
        puts "My 2nd signature: #{my_signature2}"
        puts "The expected one: #{signature}"
        puts "---"
        
        response.body = "OK"
        response.status = 200
    end
end

server = WEBrick::HTTPServer.new(:Port => 8888)

server.mount "/", MyServlet

# Ctrl + C to shutdown
trap("INT") {
    server.shutdown
}

server.start