Data Broker Opt-Out Webhooks

import crypto from "node:crypto";
import express from "express";

const app = express();
const SIGNING_SECRET = process.env.WEBHOOK_SIGNING_SECRET;

// express.raw() keeps the body as the exact bytes received.
app.post("/webhooks/purewl", express.raw({ type: "*/*" }), (req, res) => {
  const header = req.get("x-outpost-signature") || "";
  if (!header.startsWith("v0=")) return res.sendStatus(401);

  const expected = Buffer.from(
    crypto.createHmac("sha256", SIGNING_SECRET).update(req.body).digest("hex")
  );
  const received = Buffer.from(header.slice(3));
  if (expected.length !== received.length || !crypto.timingSafeEqual(expected, received)) {
    return res.sendStatus(401);
  }

  res.sendStatus(200); // respond first, then process
  const event = JSON.parse(req.body.toString("utf8"));
  // queue `event` for processing
});

import hashlib
import hmac
import os

from flask import Flask, abort, request

app = Flask(__name__)
SIGNING_SECRET = os.environ["WEBHOOK_SIGNING_SECRET"].encode()


@app.post("/webhooks/purewl")
def purewl_webhook():
    raw = request.get_data()  # the exact bytes received
    header = request.headers.get("x-outpost-signature", "")
    if not header.startswith("v0="):
        abort(401)

    expected = hmac.new(SIGNING_SECRET, raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, header[3:]):
        abort(401)

    event = request.get_json()
    # queue `event` for processing
    return "", 200