Classic ASP Requires Chilkat v11.5.0+

Box: Verify a Captured V2 Webhook Signature

See more Box Examples

Verify raw payload bytes and captured headers using the configured primary and secondary signing keys. The example rejects stale/future timestamps and compares randomized HMACs of the signatures to avoid exposing a signature-prefix timing comparison. It does not host an HTTP listener. The receiver must persist/deduplicate the verified event and acknowledge promptly.

See the Box API guide for setup and the complete workflow.

Classic ASP

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<%
success = 0

'  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
'  See Global Unlock Sample.
'  Guide: Box API Guide.

success = 0

'  Save the exact HTTP body bytes to this file, without JSON reserialization.
set rawBody = Server.CreateObject("Chilkat.BinData")
success = rawBody.LoadFile("qa_data/box_webhook_body.bin")
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( rawBody.LastErrorText) & "</pre>"
    Response.End
End If

'  Read these fields case-insensitively from the incoming request headers.
'  For this offline example, enter the captured header values.
timestamp = "BOX_DELIVERY_TIMESTAMP"
primarySignature = "BOX_SIGNATURE_PRIMARY"
secondarySignature = "BOX_SIGNATURE_SECONDARY"
signatureVersion = "1"
signatureAlgorithm = "HmacSHA256"
'  Retrieve configured keys from protected application configuration.
primaryKey = "BOX_PRIMARY_SIGNATURE_KEY"
secondaryKey = "BOX_SECONDARY_SIGNATURE_KEY"
If ((signatureVersion <> "1") Or (signatureAlgorithm <> "HmacSHA256")) Then
    Response.Write "<pre>" & Server.HTMLEncode( "Unsupported signature version or algorithm.") & "</pre>"
    Response.End
End If

set delivered = Server.CreateObject("Chilkat.CkDateTime")
success = delivered.SetFromTimestamp(timestamp)
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( delivered.LastErrorText) & "</pre>"
    Response.End
End If

set now = Server.CreateObject("Chilkat.CkDateTime")
success = now.SetFromCurrentSystemTime()
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( now.LastErrorText) & "</pre>"
    Response.End
End If

age = CLng(now.GetAsUnixTime(0)) - CLng(delivered.GetAsUnixTime(0))
'  Box recommends rejecting deliveries older than ten minutes.
'  Allow at most 60 seconds of future clock skew; keep the server clock synchronized.
If ((age > 600) Or (age < -60)) Then
    Response.Write "<pre>" & Server.HTMLEncode( "Delivery timestamp is outside the accepted window.") & "</pre>"
    Response.End
End If

set signedBytes = Server.CreateObject("Chilkat.BinData")
success = signedBytes.AppendBd(rawBody)
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( signedBytes.LastErrorText) & "</pre>"
    Response.End
End If

success = signedBytes.AppendString(timestamp,"utf-8")
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( signedBytes.LastErrorText) & "</pre>"
    Response.End
End If

set mac = Server.CreateObject("Chilkat.Crypt2")
mac.MacAlgorithm = "hmac"
mac.HashAlgorithm = "sha256"
mac.EncodingMode = "base64"
success = mac.SetMacKeyString(primaryKey)
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( mac.LastErrorText) & "</pre>"
    Response.End
End If

expectedPrimary = mac.MacBdENC(signedBytes)
If (mac.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( mac.LastErrorText) & "</pre>"
    Response.End
End If

success = mac.SetMacKeyString(secondaryKey)
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( mac.LastErrorText) & "</pre>"
    Response.End
End If

expectedSecondary = mac.MacBdENC(signedBytes)
If (mac.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( mac.LastErrorText) & "</pre>"
    Response.End
End If

'  Blind both sides with a fresh secret random key before equality comparison.
'  Never compare the original HMAC strings using a prefix-short-circuit comparison.
'  A host-language receiver can instead use its standard constant-time byte comparison.
set random = Server.CreateObject("Chilkat.Prng")
comparisonKey = random.GenRandom(32,"base64")
If (random.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( random.LastErrorText) & "</pre>"
    Response.End
End If

success = mac.SetMacKeyEncoded(comparisonKey,"base64")
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( mac.LastErrorText) & "</pre>"
    Response.End
End If

pExpected = mac.MacStringENC(expectedPrimary)
If (mac.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( mac.LastErrorText) & "</pre>"
    Response.End
End If

pReceived = mac.MacStringENC(primarySignature)
If (mac.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( mac.LastErrorText) & "</pre>"
    Response.End
End If

sExpected = mac.MacStringENC(expectedSecondary)
If (mac.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( mac.LastErrorText) & "</pre>"
    Response.End
End If

sReceived = mac.MacStringENC(secondarySignature)
If (mac.LastMethodSuccess <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( mac.LastErrorText) & "</pre>"
    Response.End
End If

validPrimary = (primaryKey <> "") And (primarySignature <> "") And (pExpected = pReceived)
validSecondary = (secondaryKey <> "") And (secondarySignature <> "") And (sExpected = sReceived)
If ((validPrimary = 0) And (validSecondary = 0)) Then
    Response.Write "<pre>" & Server.HTMLEncode( "Signature verification failed.") & "</pre>"
    Response.End
End If

'  Parse JSON only after signature verification.
set webhookEvent = Server.CreateObject("Chilkat.JsonObject")
success = webhookEvent.Load(rawBody.GetString("utf-8"))
If (success <> 1) Then
    Response.Write "<pre>" & Server.HTMLEncode( webhookEvent.LastErrorText) & "</pre>"
    Response.End
End If

Response.Write "<pre>" & Server.HTMLEncode( "Verified event ID: " & webhookEvent.StringOf("id")) & "</pre>"
Response.Write "<pre>" & Server.HTMLEncode( "Trigger: " & webhookEvent.StringOf("trigger")) & "</pre>"
'  Deduplicate using event.id, not BOX-DELIVERY-ID, which changes on retries.
'  Verify the target belongs to your configured webhook before dispatching work.

%>
</body>
</html>