Webhook (Hook URL)

app.MapPost("/webhook", async (HttpRequest req) =>
{
    using var reader = new StreamReader(req.Body);
    string body = await reader.ReadToEndAsync();

    // header: "t=<unix>,v1=<hex>"
    var sig = req.Headers["X-ECB-Signature"].ToString()
        .Split(',').Select(p => p.Split('=', 2))
        .ToDictionary(a => a[0], a => a[1]);

    string secret = "YOUR_SECRET";
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    string expected = Convert.ToHexString(
        hmac.ComputeHash(Encoding.UTF8.GetBytes(sig["t"] + "." + body)))
        .ToLowerInvariant();

    if (!CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(expected), Encoding.UTF8.GetBytes(sig["v1"])))
        return Results.Unauthorized();

    // Typed payload — DateTimeOffset decodes ISO 8601 + offset and
    // keeps the time zone (no guessing).
    var evt = JsonSerializer.Deserialize<WebhookEvent>(
        body, new JsonSerializerOptions(JsonSerializerDefaults.Web));
    Console.WriteLine($"{evt.Event} @ {evt.OccurredAt:o}");
    return Results.Ok();
});

record WebhookEvent(string Event, DateTimeOffset OccurredAt, BoothInfo Booth, JsonElement Data);
record BoothInfo(string Guid, string? Nickname);

<?php
$secret = 'YOUR_SECRET';
$body   = file_get_contents('php://input');

// header: "t=<unix>,v1=<hex>"
$header = $_SERVER['HTTP_X_ECB_SIGNATURE'] ?? '';
parse_str(str_replace(',', '&', $header), $sig);   // $sig['t'], $sig['v1']

$expected = hash_hmac('sha256', $sig['t'] . '.' . $body, $secret);
if (!hash_equals($expected, $sig['v1'] ?? '')) {
    http_response_code(401);
    exit;
}

$event = json_decode($body, true);

// DateTimeImmutable parses ISO 8601 + offset (keeps the time zone)
$occurredAt = new DateTimeImmutable($event['occurredAt']);
error_log($event['event'] . ' @ ' . $occurredAt->format(DateTimeInterface::ATOM));
http_response_code(200);

require 'sinatra'
require 'openssl'
require 'json'
require 'time'

SECRET = 'YOUR_SECRET'

post '/webhook' do
  body = request.body.read
  # header: "t=<unix>,v1=<hex>"
  sig = (request.env['HTTP_X_ECB_SIGNATURE'] || '')
          .split(',').map { |kv| kv.split('=', 2) }.to_h

  expected = OpenSSL::HMAC.hexdigest('SHA256', SECRET, "#{sig['t']}.#{body}")
  halt 401 unless Rack::Utils.secure_compare(expected, sig['v1'].to_s)

  event = JSON.parse(body)
  # Time.iso8601 keeps the offset
  occurred_at = Time.iso8601(event['occurredAt'])
  puts "#{event['event']} @ #{occurred_at.iso8601}"
  status 200
end

use axum::{body::Bytes, http::{HeaderMap, StatusCode}};
use hmac::{Hmac, Mac};
use sha2::Sha256;
use chrono::{DateTime, FixedOffset};
use serde::Deserialize;

const SECRET: &[u8] = b"YOUR_SECRET";

#[derive(Deserialize)]
struct Event {
    event: String,
    #[serde(rename = "occurredAt")]
    occurred_at: DateTime<FixedOffset>,   // ISO 8601 + offset
}

async fn webhook(headers: HeaderMap, body: Bytes) -> StatusCode {
    let header = headers.get("X-ECB-Signature")
        .and_then(|v| v.to_str().ok()).unwrap_or("");

    // header: "t=<unix>,v1=<hex>"
    let (mut t, mut v1) = ("", "");
    for kv in header.split(',') {
        match kv.split_once('=') {
            Some(("t", v))  => t = v,
            Some(("v1", v)) => v1 = v,
            _ => {}
        }
    }

    let mut mac = Hmac::<Sha256>::new_from_slice(SECRET).unwrap();
    mac.update(format!("{t}.").as_bytes());
    mac.update(&body);
    match hex::decode(v1) {
        Ok(raw) if mac.verify_slice(&raw).is_ok() => {}
        _ => return StatusCode::UNAUTHORIZED,
    }

    let evt: Event = serde_json::from_slice(&body).unwrap();
    println!("{} @ {}", evt.event, evt.occurred_at);
    StatusCode::OK
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "strings"
    "time"
)

const secret = "YOUR_SECRET"

type Event struct {
    Event      string    `json:"event"`
    OccurredAt time.Time `json:"occurredAt"`   // RFC3339 -> time.Time (with offset)
}

func webhook(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)

    // header: "t=<unix>,v1=<hex>"
    sig := map[string]string{}
    for _, kv := range strings.Split(r.Header.Get("X-ECB-Signature"), ",") {
        if p := strings.SplitN(kv, "=", 2); len(p) == 2 {
            sig[p[0]] = p[1]
        }
    }

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(sig["t"] + "." + string(body)))
    expected := hex.EncodeToString(mac.Sum(nil))
    if !hmac.Equal([]byte(expected), []byte(sig["v1"])) {
        w.WriteHeader(http.StatusUnauthorized)
        return
    }

    var evt Event
    json.Unmarshal(body, &evt)   // OccurredAt keeps its offset
    fmt.Printf("%s @ %s\n", evt.Event, evt.OccurredAt.Format(time.RFC3339Nano))
    w.WriteHeader(http.StatusOK)
}

const express = require('express');
const crypto  = require('crypto');
const app = express();

const SECRET = 'YOUR_SECRET';

// keep the RAW body so the signature matches
app.use(express.raw({ type: 'application/json' }));

app.post('/webhook', (req, res) => {
  const raw = req.body;                         // Buffer
  const header = req.get('X-ECB-Signature') || '';
  const sig = Object.fromEntries(header.split(',').map(kv => kv.split('=')));

  const expected = crypto.createHmac('sha256', SECRET)
    .update(sig.t + '.' + raw.toString('utf8'))
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig.v1 || ''))) {
    return res.sendStatus(401);
  }

  const event = JSON.parse(raw.toString('utf8'));
  // Date parses ISO 8601 + offset (stored as the correct UTC instant).
  // For the ORIGINAL offset use Luxon: DateTime.fromISO(event.occurredAt, { setZone: true })
  const occurredAt = new Date(event.occurredAt);
  console.log(event.event, '@', occurredAt.toISOString());
  res.sendStatus(200);
});

app.listen(8080);

import hmac, hashlib, json
from flask import Flask, request, abort
from dateutil import parser            # pip install python-dateutil

SECRET = b'YOUR_SECRET'
app = Flask(__name__)

@app.post('/webhook')
def webhook():
    raw = request.get_data()                  # raw bytes
    header = request.headers.get('X-ECB-Signature', '')
    sig = dict(kv.split('=', 1) for kv in header.split(','))

    msg = (sig['t'] + '.').encode() + raw
    expected = hmac.new(SECRET, msg, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig.get('v1', '')):
        abort(401)

    event = json.loads(raw)
    # isoparse keeps the offset AND handles .NET's 7-digit fractional
    # (datetime.fromisoformat only accepts up to 6 digits)
    occurred_at = parser.isoparse(event['occurredAt'])
    print(event['event'], '@', occurred_at.isoformat())
    return '', 200

import javax.servlet.http.*;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.OffsetDateTime;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;

public class WebhookServlet extends HttpServlet {
    static final String SECRET = "YOUR_SECRET";
    static final ObjectMapper MAPPER = new ObjectMapper();

    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws Exception {
        byte[] body = req.getInputStream().readAllBytes();

        // header: "t=<unix>,v1=<hex>"
        String header = req.getHeader("X-ECB-Signature");
        String t = "", v1 = "";
        for (String kv : header.split(",")) {
            String[] p = kv.split("=", 2);
            if (p[0].equals("t"))  t = p[1];
            if (p[0].equals("v1")) v1 = p[1];
        }

        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(
            SECRET.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        mac.update((t + ".").getBytes(StandardCharsets.UTF_8));
        byte[] hash = mac.doFinal(body);

        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));

        if (!MessageDigest.isEqual(hex.toString().getBytes(), v1.getBytes())) {
            resp.setStatus(401);
            return;
        }

        JsonNode root = MAPPER.readTree(body);
        // OffsetDateTime.parse decodes ISO 8601 + offset + fractional
        OffsetDateTime occurredAt = OffsetDateTime.parse(root.get("occurredAt").asText());
        System.out.println(root.get("event").asText() + " @ " + occurredAt);
        resp.setStatus(200);
    }
}