ReOTP.
Aabo ati Iṣẹpọ/Webhooks ati HMAC
1 ìṣẹ́jú kíkà

Webhooks ati HMAC

Kọ ẹkọ bi o ṣe le gba awọn iwifunni akoko gidi ni aabo nigbati nọmba foonu kan ba jẹrisi.

Awọn Webhooks jẹ ọna ti o yara julọ ati ailewu julọ lati mọ pe olumulo ti jẹrisi ni aṣeyọri laisi iwulo lati ṣe SSE (Server-Sent Events) (ayẹwo nigbagbogbo).

Nigbati olumulo ba firanṣẹ ifiranṣẹ naa ti o si baamu ni aṣeyọri, eto wa yoo firanṣẹ ibeere POST si URL kan ti o ti yan tẹlẹ ninu awọn eto iṣẹ naa.

Aabo Webhook (HMAC Signature)

Lati rii daju pe awọn ibeere n bọ gangan lati awọn serva wa kii ṣe awọn ikọlu eke, a fowo si gbogbo ibeere nipa lilo algoridimu HMAC-SHA256.

1. Lọ si awọn eto iṣẹ ki o ṣe ipilẹṣẹ Webhook Secret.

2. Wọn yoo so ibuwọlu ti a yipada sinu akọsori ibeere (Header) ti a pe ni x-webhook-signature.

3. O gbọdọ ṣe iṣiro ibuwọlu naa lori sẹfa rẹ nipa lilo Secret ti ara rẹ ki o ṣe aferi rẹ pẹlu ibuwọlu ti a firanṣẹ.

Kóòdù Ìṣàkópọ̀ (SDKs)
const express = require('express');
const crypto = require('crypto');
const app = express();

const WEBHOOK_SECRET = 'your_webhook_secret_here';

// Must parse raw body to verify signature correctly
app.use(express.json());

app.post('/webhook/reotp', (req, res) => {
  const signatureHeader = req.headers['x-webhook-signature'];
  const payloadString = JSON.stringify(req.body);

  // Calculate HMAC SHA256
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(payloadString)
    .digest('hex');

  // Securely compare signatures
  if (signatureHeader !== expectedSignature) {
    return res.status(401).send('Invalid signature');
  }

  // Handle successful verification
  const { event, phoneNumber, requestId } = req.body;
  if (event === 'verification.success') {
    console.log(`User ${phoneNumber} verified! (ID: ${requestId})`);
    // Login user, create session, update DB, etc.
  }

  // Must return 200 OK so we know it was delivered
  res.status(200).send('OK');
});

app.listen(3000, () => console.log('Listening for Webhooks...'));
Àpilẹ̀kọ Tí Ó KànÌnasẹ̀sọ̀rọ̀ sí ReOTP