Webhook Integration

const crypto = require('crypto');
const express = require('express');
const app = express();

// Must use raw body for signature verification
app.use('/webhook', express.raw({ type: 'application/json' }));

app.post('/webhook/inbound', (req, res) => {
  const signature = req.headers['x-mailbreeze-signature'];
  const webhookSecret = process.env.MAILBREEZE_WEBHOOK_SECRET;

  if (!verifySignature(signature, req.body, webhookSecret)) {
    return res.status(401).send('Invalid signature');
  }

  const payload = JSON.parse(req.body);

  // Process the email
  console.log('Received email from:', payload.data.from.address);

  res.status(200).send('OK');
});

function verifySignature(sigHeader, body, secret) {
  const [tPart, v1Part] = sigHeader.split(',');
  const timestamp = tPart.split('=')[1];
  const signature = v1Part.split('=')[1];

  // Check timestamp (5 minute tolerance)
  const age = Date.now() - (parseInt(timestamp) * 1000);
  if (age > 5 * 60 * 1000) return false;

  // Compute expected signature
  const signedPayload = `${timestamp}.${body}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Timing-safe comparison
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

import hmac
import hashlib
import time
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = os.environ['MAILBREEZE_WEBHOOK_SECRET']

@app.route('/webhook/inbound', methods=['POST'])
def handle_inbound():
    signature = request.headers.get('X-MailBreeze-Signature')

    if not verify_signature(signature, request.data, WEBHOOK_SECRET):
        abort(401, 'Invalid signature')

    payload = request.json

    # Process the email
    print(f"Received email from: {payload['data']['from']['address']}")

    return 'OK', 200

def verify_signature(sig_header, body, secret):
    parts = dict(p.split('=') for p in sig_header.split(','))
    timestamp = parts['t']
    signature = parts['v1']

    # Check timestamp (5 minute tolerance)
    age = time.time() - int(timestamp)
    if age > 5 * 60:
        return False

    # Compute expected signature
    signed_payload = f"{timestamp}.{body.decode('utf-8')}"
    expected = hmac.new(
        secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected)

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"net/http"
	"strconv"
	"strings"
	"time"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	body, _ := io.ReadAll(r.Body)
	signature := r.Header.Get("X-MailBreeze-Signature")
	secret := os.Getenv("MAILBREEZE_WEBHOOK_SECRET")

	if !verifySignature(signature, body, secret) {
		http.Error(w, "Invalid signature", http.StatusUnauthorized)
		return
	}

	// Process the email
	// ...

	w.WriteHeader(http.StatusOK)
	w.Write([]byte("OK"))
}

func verifySignature(sigHeader string, body []byte, secret string) bool {
	parts := strings.Split(sigHeader, ",")
	timestamp := strings.Split(parts[0], "=")[1]
	signature := strings.Split(parts[1], "=")[1]

	// Check timestamp (5 minute tolerance)
	ts, _ := strconv.ParseInt(timestamp, 10, 64)
	if time.Now().Unix()-ts > 300 {
		return false
	}

	// Compute expected signature
	signedPayload := timestamp + "." + string(body)
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(signedPayload))
	expected := hex.EncodeToString(mac.Sum(nil))

	return hmac.Equal([]byte(signature), []byte(expected))
}

<?php
$webhookSecret = getenv('MAILBREEZE_WEBHOOK_SECRET');
$signature = $_SERVER['HTTP_X_MAILBREEZE_SIGNATURE'];
$body = file_get_contents('php://input');

if (!verifySignature($signature, $body, $webhookSecret)) {
    http_response_code(401);
    exit('Invalid signature');
}

$payload = json_decode($body, true);

// Process the email
error_log("Received email from: " . $payload['data']['from']['address']);

http_response_code(200);
echo 'OK';

function verifySignature($sigHeader, $body, $secret) {
    $parts = [];
    foreach (explode(',', $sigHeader) as $part) {
        list($key, $value) = explode('=', $part, 2);
        $parts[$key] = $value;
    }

    $timestamp = $parts['t'];
    $signature = $parts['v1'];

    // Check timestamp (5 minute tolerance)
    if (time() - intval($timestamp) > 300) {
        return false;
    }

    // Compute expected signature
    $signedPayload = $timestamp . '.' . $body;
    $expected = hash_hmac('sha256', $signedPayload, $secret);

    return hash_equals($signature, $expected);
}
?>