Web Hook Verification

When integrating Inqud web hooks into your application, it's crucial to verify the authenticity of incoming web hook requests. This ensures that the requests are genuinely from Inqud and not from a malicious source. Inqud includes an HMAC-SHA1 signature in the X-Payload-Digest header of each web hook request, which you can use to verify the request.

Below is a sample Python function that demonstrates how to verify the signature of a webhook request:

import hashlib
import hmac
import binascii

SECRET = 'secret_value' #value set as webhook secret

def verifySignature(callback_raw_response, callback_headers):
    callback_signature = callback_headers['X-Payload-Digest']
    dig = hmac.new(bytes(SECRET , 'utf-8'), bytes(callback_raw_response , 'utf-8'), hashlib.sha1).digest()
    signature = binascii.hexlify(dig).decode()
    return callback_signature == signature

callback_raw_response = '{"field":"value"}' # use raw unformatted response body
callback_headers = {"X-Payload-Digest": "7e36242a10fd65cbaacd7ff288df9fd3f9e75a46"} # header from response

print(verifySignature(callback_raw_response, callback_headers))

1. Secret Value: The SECRET variable should be set to the secret value you supplied during create of a webhook.

2. Verify Signature Function: The verifySignature function takes the raw response body (callback_raw_response) and the headers (callback_headers) of the web hook request.

   1. it extracts the signature from the X-Payload-Digest header.

   2. It then generates a new HMAC-SHA1 signature using the secret value and the raw response body.

   3. Finally, it compares the generated signature with the signature from the header and returns True if they match, indicating that the webhook is authentic.

3. Sample Data: The callback_raw_response and callback_headers variables contain sample data for testing the function.