C Requires Chilkat v11.5.0+
C
Box: Verify a Captured V2 Webhook Signature
See more Box Examples
Verify raw payload bytes and captured headers using the configured primary and secondary signing keys. The example rejects stale/future timestamps and compares randomized HMACs of the signatures to avoid exposing a signature-prefix timing comparison. It does not host an HTTP listener. The receiver must persist/deduplicate the verified event and acknowledge promptly.
See the Box API guide for setup and the complete workflow.
Chilkat C Downloads
#include <C_CkBinData.h>
#include <C_CkDateTime.h>
#include <C_CkCrypt2.h>
#include <C_CkPrng.h>
#include <C_CkJsonObject.h>
void ChilkatSample(void)
{
BOOL success;
HCkBinData rawBody;
const char *timestamp;
const char *primarySignature;
const char *secondarySignature;
const char *signatureVersion;
const char *signatureAlgorithm;
const char *primaryKey;
const char *secondaryKey;
HCkDateTime delivered;
HCkDateTime now;
int age;
HCkBinData signedBytes;
HCkCrypt2 mac;
const char *expectedPrimary;
const char *expectedSecondary;
HCkPrng random;
const char *comparisonKey;
const char *pExpected;
const char *pReceived;
const char *sExpected;
const char *sReceived;
BOOL validPrimary;
BOOL validSecondary;
HCkJsonObject webhookEvent;
success = FALSE;
// Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
// See Global Unlock Sample.
// Guide: Box API Guide.
success = FALSE;
// Save the exact HTTP body bytes to this file, without JSON reserialization.
rawBody = CkBinData_Create();
success = CkBinData_LoadFile(rawBody,"qa_data/box_webhook_body.bin");
if (success != TRUE) {
printf("%s\n",CkBinData_lastErrorText(rawBody));
CkBinData_Dispose(rawBody);
return;
}
// Read these fields case-insensitively from the incoming request headers.
// For this offline example, enter the captured header values.
timestamp = "BOX_DELIVERY_TIMESTAMP";
primarySignature = "BOX_SIGNATURE_PRIMARY";
secondarySignature = "BOX_SIGNATURE_SECONDARY";
signatureVersion = "1";
signatureAlgorithm = "HmacSHA256";
// Retrieve configured keys from protected application configuration.
primaryKey = "BOX_PRIMARY_SIGNATURE_KEY";
secondaryKey = "BOX_SECONDARY_SIGNATURE_KEY";
if ((signatureVersion != "1") || (signatureAlgorithm != "HmacSHA256")) {
printf("Unsupported signature version or algorithm.\n");
CkBinData_Dispose(rawBody);
return;
}
delivered = CkDateTime_Create();
success = CkDateTime_SetFromTimestamp(delivered,timestamp);
if (success != TRUE) {
printf("%s\n",CkDateTime_lastErrorText(delivered));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
return;
}
now = CkDateTime_Create();
success = CkDateTime_SetFromCurrentSystemTime(now);
if (success != TRUE) {
printf("%s\n",CkDateTime_lastErrorText(now));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
return;
}
age = atoi(CkDateTime_GetAsUnixTime(now,FALSE)) - atoi(CkDateTime_GetAsUnixTime(delivered,FALSE));
// Box recommends rejecting deliveries older than ten minutes.
// Allow at most 60 seconds of future clock skew; keep the server clock synchronized.
if ((age > 600) || (age < -60)) {
printf("Delivery timestamp is outside the accepted window.\n");
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
return;
}
signedBytes = CkBinData_Create();
success = CkBinData_AppendBd(signedBytes,rawBody);
if (success != TRUE) {
printf("%s\n",CkBinData_lastErrorText(signedBytes));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
return;
}
success = CkBinData_AppendString(signedBytes,timestamp,"utf-8");
if (success != TRUE) {
printf("%s\n",CkBinData_lastErrorText(signedBytes));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
return;
}
mac = CkCrypt2_Create();
CkCrypt2_putMacAlgorithm(mac,"hmac");
CkCrypt2_putHashAlgorithm(mac,"sha256");
CkCrypt2_putEncodingMode(mac,"base64");
success = CkCrypt2_SetMacKeyString(mac,primaryKey);
if (success != TRUE) {
printf("%s\n",CkCrypt2_lastErrorText(mac));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
return;
}
expectedPrimary = CkCrypt2_macBdENC(mac,signedBytes);
if (CkCrypt2_getLastMethodSuccess(mac) != TRUE) {
printf("%s\n",CkCrypt2_lastErrorText(mac));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
return;
}
success = CkCrypt2_SetMacKeyString(mac,secondaryKey);
if (success != TRUE) {
printf("%s\n",CkCrypt2_lastErrorText(mac));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
return;
}
expectedSecondary = CkCrypt2_macBdENC(mac,signedBytes);
if (CkCrypt2_getLastMethodSuccess(mac) != TRUE) {
printf("%s\n",CkCrypt2_lastErrorText(mac));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
return;
}
// Blind both sides with a fresh secret random key before equality comparison.
// Never compare the original HMAC strings using a prefix-short-circuit comparison.
// A host-language receiver can instead use its standard constant-time byte comparison.
random = CkPrng_Create();
comparisonKey = CkPrng_genRandom(random,32,"base64");
if (CkPrng_getLastMethodSuccess(random) != TRUE) {
printf("%s\n",CkPrng_lastErrorText(random));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
CkPrng_Dispose(random);
return;
}
success = CkCrypt2_SetMacKeyEncoded(mac,comparisonKey,"base64");
if (success != TRUE) {
printf("%s\n",CkCrypt2_lastErrorText(mac));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
CkPrng_Dispose(random);
return;
}
pExpected = CkCrypt2_macStringENC(mac,expectedPrimary);
if (CkCrypt2_getLastMethodSuccess(mac) != TRUE) {
printf("%s\n",CkCrypt2_lastErrorText(mac));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
CkPrng_Dispose(random);
return;
}
pReceived = CkCrypt2_macStringENC(mac,primarySignature);
if (CkCrypt2_getLastMethodSuccess(mac) != TRUE) {
printf("%s\n",CkCrypt2_lastErrorText(mac));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
CkPrng_Dispose(random);
return;
}
sExpected = CkCrypt2_macStringENC(mac,expectedSecondary);
if (CkCrypt2_getLastMethodSuccess(mac) != TRUE) {
printf("%s\n",CkCrypt2_lastErrorText(mac));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
CkPrng_Dispose(random);
return;
}
sReceived = CkCrypt2_macStringENC(mac,secondarySignature);
if (CkCrypt2_getLastMethodSuccess(mac) != TRUE) {
printf("%s\n",CkCrypt2_lastErrorText(mac));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
CkPrng_Dispose(random);
return;
}
validPrimary = (primaryKey != "") && (primarySignature != "") && (pExpected == pReceived);
validSecondary = (secondaryKey != "") && (secondarySignature != "") && (sExpected == sReceived);
if ((validPrimary == FALSE) && (validSecondary == FALSE)) {
printf("Signature verification failed.\n");
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
CkPrng_Dispose(random);
return;
}
// Parse JSON only after signature verification.
webhookEvent = CkJsonObject_Create();
success = CkJsonObject_Load(webhookEvent,CkBinData_getString(rawBody,"utf-8"));
if (success != TRUE) {
printf("%s\n",CkJsonObject_lastErrorText(webhookEvent));
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
CkPrng_Dispose(random);
CkJsonObject_Dispose(webhookEvent);
return;
}
printf("Verified event ID: %s\n",CkJsonObject_stringOf(webhookEvent,"id"));
printf("Trigger: %s\n",CkJsonObject_stringOf(webhookEvent,"trigger"));
// Deduplicate using event.id, not BOX-DELIVERY-ID, which changes on retries.
// Verify the target belongs to your configured webhook before dispatching work.
CkBinData_Dispose(rawBody);
CkDateTime_Dispose(delivered);
CkDateTime_Dispose(now);
CkBinData_Dispose(signedBytes);
CkCrypt2_Dispose(mac);
CkPrng_Dispose(random);
CkJsonObject_Dispose(webhookEvent);
}