Go Requires Chilkat v11.5.0+

Box: Verify a Captured V2 Webhook Signature

See more Box Examples

Verify raw payload bytes and captured headers using the configured primary and secondary signing keys. The example rejects stale/future timestamps and compares randomized HMACs of the signatures to avoid exposing a signature-prefix timing comparison. It does not host an HTTP listener. The receiver must persist/deduplicate the verified event and acknowledge promptly.

See the Box API guide for setup and the complete workflow.

Go

    success := false

    //  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
    //  See Global Unlock Sample.
    //  Guide: Box API Guide.

    success = false

    //  Save the exact HTTP body bytes to this file, without JSON reserialization.
    rawBody := chilkat.NewBinData()
    success = rawBody.LoadFile("qa_data/box_webhook_body.bin")
    if success != true {
        fmt.Println(rawBody.LastErrorText())
        rawBody.DisposeBinData()
        return
    }

    //  Read these fields case-insensitively from the incoming request headers.
    //  For this offline example, enter the captured header values.
    timestamp := "BOX_DELIVERY_TIMESTAMP"
    primarySignature := "BOX_SIGNATURE_PRIMARY"
    secondarySignature := "BOX_SIGNATURE_SECONDARY"
    signatureVersion := "1"
    signatureAlgorithm := "HmacSHA256"
    //  Retrieve configured keys from protected application configuration.
    primaryKey := "BOX_PRIMARY_SIGNATURE_KEY"
    secondaryKey := "BOX_SECONDARY_SIGNATURE_KEY"
    if (signatureVersion != "1") || (signatureAlgorithm != "HmacSHA256") {
        fmt.Println("Unsupported signature version or algorithm.")
        rawBody.DisposeBinData()
        return
    }

    delivered := chilkat.NewCkDateTime()
    success = delivered.SetFromTimestamp(timestamp)
    if success != true {
        fmt.Println(delivered.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        return
    }

    now := chilkat.NewCkDateTime()
    success = now.SetFromCurrentSystemTime()
    if success != true {
        fmt.Println(now.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        return
    }

    age := int(now.GetAsUnixTime(false)) - int(delivered.GetAsUnixTime(false))
    //  Box recommends rejecting deliveries older than ten minutes.
    //  Allow at most 60 seconds of future clock skew; keep the server clock synchronized.
    if (age > 600) || (age < -60) {
        fmt.Println("Delivery timestamp is outside the accepted window.")
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        return
    }

    signedBytes := chilkat.NewBinData()
    success = signedBytes.AppendBd(rawBody)
    if success != true {
        fmt.Println(signedBytes.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        return
    }

    success = signedBytes.AppendString(timestamp,"utf-8")
    if success != true {
        fmt.Println(signedBytes.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        return
    }

    mac := chilkat.NewCrypt2()
    mac.SetMacAlgorithm("hmac")
    mac.SetHashAlgorithm("sha256")
    mac.SetEncodingMode("base64")
    success = mac.SetMacKeyString(primaryKey)
    if success != true {
        fmt.Println(mac.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        return
    }

    expectedPrimary := mac.MacBdENC(signedBytes)
    if mac.LastMethodSuccess() != true {
        fmt.Println(mac.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        return
    }

    success = mac.SetMacKeyString(secondaryKey)
    if success != true {
        fmt.Println(mac.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        return
    }

    expectedSecondary := mac.MacBdENC(signedBytes)
    if mac.LastMethodSuccess() != true {
        fmt.Println(mac.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        return
    }

    //  Blind both sides with a fresh secret random key before equality comparison.
    //  Never compare the original HMAC strings using a prefix-short-circuit comparison.
    //  A host-language receiver can instead use its standard constant-time byte comparison.
    random := chilkat.NewPrng()
    comparisonKey := random.GenRandom(32,"base64")
    if random.LastMethodSuccess() != true {
        fmt.Println(random.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        random.DisposePrng()
        return
    }

    success = mac.SetMacKeyEncoded(*comparisonKey,"base64")
    if success != true {
        fmt.Println(mac.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        random.DisposePrng()
        return
    }

    pExpected := mac.MacStringENC(*expectedPrimary)
    if mac.LastMethodSuccess() != true {
        fmt.Println(mac.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        random.DisposePrng()
        return
    }

    pReceived := mac.MacStringENC(primarySignature)
    if mac.LastMethodSuccess() != true {
        fmt.Println(mac.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        random.DisposePrng()
        return
    }

    sExpected := mac.MacStringENC(*expectedSecondary)
    if mac.LastMethodSuccess() != true {
        fmt.Println(mac.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        random.DisposePrng()
        return
    }

    sReceived := mac.MacStringENC(secondarySignature)
    if mac.LastMethodSuccess() != true {
        fmt.Println(mac.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        random.DisposePrng()
        return
    }

    validPrimary := (primaryKey != "") && (primarySignature != "") && (*pExpected == *pReceived)
    validSecondary := (secondaryKey != "") && (secondarySignature != "") && (*sExpected == *sReceived)
    if (validPrimary == false) && (validSecondary == false) {
        fmt.Println("Signature verification failed.")
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        random.DisposePrng()
        return
    }

    //  Parse JSON only after signature verification.
    webhookEvent := chilkat.NewJsonObject()
    success = webhookEvent.Load(*rawBody.GetString("utf-8"))
    if success != true {
        fmt.Println(webhookEvent.LastErrorText())
        rawBody.DisposeBinData()
        delivered.DisposeCkDateTime()
        now.DisposeCkDateTime()
        signedBytes.DisposeBinData()
        mac.DisposeCrypt2()
        random.DisposePrng()
        webhookEvent.DisposeJsonObject()
        return
    }

    fmt.Println("Verified event ID: ", *webhookEvent.StringOf("id"))
    fmt.Println("Trigger: ", *webhookEvent.StringOf("trigger"))
    //  Deduplicate using event.id, not BOX-DELIVERY-ID, which changes on retries.
    //  Verify the target belongs to your configured webhook before dispatching work.

    rawBody.DisposeBinData()
    delivered.DisposeCkDateTime()
    now.DisposeCkDateTime()
    signedBytes.DisposeBinData()
    mac.DisposeCrypt2()
    random.DisposePrng()
    webhookEvent.DisposeJsonObject()