Xojo Plugin Requires Chilkat v11.5.0+

Box: Verify a Captured V2 Webhook Signature

See more Box Examples

Verify raw payload bytes and captured headers using the configured primary and secondary signing keys. The example rejects stale/future timestamps and compares randomized HMACs of the signatures to avoid exposing a signature-prefix timing comparison. It does not host an HTTP listener. The receiver must persist/deduplicate the verified event and acknowledge promptly.

See the Box API guide for setup and the complete workflow.

Xojo Plugin

Dim success As Boolean
success = False

//  Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
//  See Global Unlock Sample.
//  Guide: Box API Guide.

success = False

//  Save the exact HTTP body bytes to this file, without JSON reserialization.
Dim rawBody As New Chilkat.BinData
success = rawBody.LoadFile("qa_data/box_webhook_body.bin")
If (success <> True) Then
    System.DebugLog(rawBody.LastErrorText)
    Return
End If

//  Read these fields case-insensitively from the incoming request headers.
//  For this offline example, enter the captured header values.
Dim timestamp As String
timestamp = "BOX_DELIVERY_TIMESTAMP"
Dim primarySignature As String
primarySignature = "BOX_SIGNATURE_PRIMARY"
Dim secondarySignature As String
secondarySignature = "BOX_SIGNATURE_SECONDARY"
Dim signatureVersion As String
signatureVersion = "1"
Dim signatureAlgorithm As String
signatureAlgorithm = "HmacSHA256"
//  Retrieve configured keys from protected application configuration.
Dim primaryKey As String
primaryKey = "BOX_PRIMARY_SIGNATURE_KEY"
Dim secondaryKey As String
secondaryKey = "BOX_SECONDARY_SIGNATURE_KEY"
If ((signatureVersion <> "1") Or (signatureAlgorithm <> "HmacSHA256")) Then
    System.DebugLog("Unsupported signature version or algorithm.")
    Return
End If

Dim delivered As New Chilkat.CkDateTime
success = delivered.SetFromTimestamp(timestamp)
If (success <> True) Then
    System.DebugLog(delivered.LastErrorText)
    Return
End If

Dim now As New Chilkat.CkDateTime
success = now.SetFromCurrentSystemTime()
If (success <> True) Then
    System.DebugLog(now.LastErrorText)
    Return
End If

Dim age As Int32
age = Val(now.GetAsUnixTime(False)) - Val(delivered.GetAsUnixTime(False))
//  Box recommends rejecting deliveries older than ten minutes.
//  Allow at most 60 seconds of future clock skew; keep the server clock synchronized.
If ((age > 600) Or (age < -60)) Then
    System.DebugLog("Delivery timestamp is outside the accepted window.")
    Return
End If

Dim signedBytes As New Chilkat.BinData
success = signedBytes.AppendBd(rawBody)
If (success <> True) Then
    System.DebugLog(signedBytes.LastErrorText)
    Return
End If

success = signedBytes.AppendString(timestamp,"utf-8")
If (success <> True) Then
    System.DebugLog(signedBytes.LastErrorText)
    Return
End If

Dim mac As New Chilkat.Crypt2
mac.MacAlgorithm = "hmac"
mac.HashAlgorithm = "sha256"
mac.EncodingMode = "base64"
success = mac.SetMacKeyString(primaryKey)
If (success <> True) Then
    System.DebugLog(mac.LastErrorText)
    Return
End If

Dim expectedPrimary As String
expectedPrimary = mac.MacBdENC(signedBytes)
If (mac.LastMethodSuccess <> True) Then
    System.DebugLog(mac.LastErrorText)
    Return
End If

success = mac.SetMacKeyString(secondaryKey)
If (success <> True) Then
    System.DebugLog(mac.LastErrorText)
    Return
End If

Dim expectedSecondary As String
expectedSecondary = mac.MacBdENC(signedBytes)
If (mac.LastMethodSuccess <> True) Then
    System.DebugLog(mac.LastErrorText)
    Return
End If

//  Blind both sides with a fresh secret random key before equality comparison.
//  Never compare the original HMAC strings using a prefix-short-circuit comparison.
//  A host-language receiver can instead use its standard constant-time byte comparison.
Dim random As New Chilkat.Prng
Dim comparisonKey As String
comparisonKey = random.GenRandom(32,"base64")
If (random.LastMethodSuccess <> True) Then
    System.DebugLog(random.LastErrorText)
    Return
End If

success = mac.SetMacKeyEncoded(comparisonKey,"base64")
If (success <> True) Then
    System.DebugLog(mac.LastErrorText)
    Return
End If

Dim pExpected As String
pExpected = mac.MacStringENC(expectedPrimary)
If (mac.LastMethodSuccess <> True) Then
    System.DebugLog(mac.LastErrorText)
    Return
End If

Dim pReceived As String
pReceived = mac.MacStringENC(primarySignature)
If (mac.LastMethodSuccess <> True) Then
    System.DebugLog(mac.LastErrorText)
    Return
End If

Dim sExpected As String
sExpected = mac.MacStringENC(expectedSecondary)
If (mac.LastMethodSuccess <> True) Then
    System.DebugLog(mac.LastErrorText)
    Return
End If

Dim sReceived As String
sReceived = mac.MacStringENC(secondarySignature)
If (mac.LastMethodSuccess <> True) Then
    System.DebugLog(mac.LastErrorText)
    Return
End If

Dim validPrimary As Boolean
validPrimary = (primaryKey <> "") And (primarySignature <> "") And (pExpected = pReceived)
Dim validSecondary As Boolean
validSecondary = (secondaryKey <> "") And (secondarySignature <> "") And (sExpected = sReceived)
If ((validPrimary = False) And (validSecondary = False)) Then
    System.DebugLog("Signature verification failed.")
    Return
End If

//  Parse JSON only after signature verification.
Dim webhookEvent As New Chilkat.JsonObject
success = webhookEvent.Load(rawBody.GetString("utf-8"))
If (success <> True) Then
    System.DebugLog(webhookEvent.LastErrorText)
    Return
End If

System.DebugLog("Verified event ID: " + webhookEvent.StringOf("id"))
System.DebugLog("Trigger: " + webhookEvent.StringOf("trigger"))
//  Deduplicate using event.id, not BOX-DELIVERY-ID, which changes on retries.
//  Verify the target belongs to your configured webhook before dispatching work.