Webhooks

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const secret = process.env.SCREENSHOTLY_WEBHOOK_SECRET;

function isValidSignature(rawBody, header) {
  if (typeof header !== 'string' || !header.startsWith('sha256=')) return false;
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  const received = header.slice('sha256='.length);
  return received.length === expected.length
    && crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
}

// express.raw keeps the exact bytes that were signed.
app.post('/screenshotly', express.raw({ type: 'application/json' }), (req, res) => {
  if (!isValidSignature(req.body, req.get('X-Screenshotly-Signature'))) {
    return res.sendStatus(401);
  }
  const event = JSON.parse(req.body.toString('utf8'));
  res.sendStatus(204);
  // Process the event after responding, e.g. enqueue it for a worker.
  console.log(event.event, event.data.storageUrl);
});

app.listen(3000);

import hashlib
import hmac
import os
from typing import Optional

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["SCREENSHOTLY_WEBHOOK_SECRET"].encode()


def is_valid_signature(raw_body: bytes, header: Optional[str]) -> bool:
    if not header or not header.startswith("sha256="):
        return False
    expected = hmac.new(SECRET, raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(header.removeprefix("sha256="), expected)


@app.post("/screenshotly")
def screenshotly_webhook():
    raw_body = request.get_data()
    if not is_valid_signature(raw_body, request.headers.get("X-Screenshotly-Signature")):
        abort(401)
    event = request.get_json()
    print(event["event"], event["data"].get("storageUrl"))
    return "", 204