ReOTP.
Xavfsizlik va sinxronizatsiya/Veb-huklar (Webhooks) va HMAC
1 daqiqa oʻqish

Veb-huklar (Webhooks) va HMAC

Telefon raqamini tasdiqlashda xavfsiz ancha bildirishnomalarni qanday qabul qilishni o'rganing.

Veb-huklar (Webhooks) — foydalanuvchi muvaffaqiyatli tasdiqlanganligini, SSE (Server-Sent Events) (doimiy tekshiruv) qilmasdan bilishning eng tez va xavfsiz usulidir.

Foydalanuvchi xabar yuborganida va bu muvaffaqiyatli mos kelganda, tizimimiz siz avvaldan loyoha sozlamalarida ko'rsatgan URL manziliga POST so'rovi yuboradi.

Veb-huk xavfsizligi (HMAC imzosi)

So'rovlar haqiqatan ham bizning serverlarimizdan keldigini, va bu jaliy hujum emasligini kafolatlash uchun, har bir so'rovni HMAC-SHA256 algoritmi bilan imzalaymiz.

1. Loyiha sozlamalariga o'tib, Webhook Secret yarating.

2. Shifrlangan imzo so'rovning sarlavhasiga (Header) x-webhook-signature nomi bilan qo'shiladi.

3. Siz serveringizda o'zingizning Secret kalitingiz yordamida imzoni hisoblang va yuborilgan imzo bilan solishtiring.

Integratsiya kodi (SDKlar)
const express = require('express');
const crypto = require('crypto');
const app = express();

const WEBHOOK_SECRET = 'your_webhook_secret_here';

// Must parse raw body to verify signature correctly
app.use(express.json());

app.post('/webhook/reotp', (req, res) => {
  const signatureHeader = req.headers['x-webhook-signature'];
  const payloadString = JSON.stringify(req.body);

  // Calculate HMAC SHA256
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(payloadString)
    .digest('hex');

  // Securely compare signatures
  if (signatureHeader !== expectedSignature) {
    return res.status(401).send('Invalid signature');
  }

  // Handle successful verification
  const { event, phoneNumber, requestId } = req.body;
  if (event === 'verification.success') {
    console.log(`User ${phoneNumber} verified! (ID: ${requestId})`);
    // Login user, create session, update DB, etc.
  }

  // Must return 200 OK so we know it was delivered
  res.status(200).send('OK');
});

app.listen(3000, () => console.log('Listening for Webhooks...'));
Keyingi maqolaReOTP haqida kirish