Webhook DLR

$raw = file_get_contents('php://input');
$sig = $_SERVER['HTTP_X_ZGATEWAY_SIGNATURE'] ?? '';

$expected = hash_hmac('sha256', $raw, getenv('ADFLEX_API_KEY'));
if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit;
}

$dlr = json_decode($raw, true);
markDelivered($dlr['client_req_id'], $dlr['delivered_at']);

http_response_code(200);
echo 'ok';

import crypto from 'crypto';
import express from 'express';

const app = express();

// express.raw() giữ body thô, bắt buộc để tính chữ ký
app.post('/dlr', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.get('X-Zgateway-Signature') ?? '';
  const expected = crypto
    .createHmac('sha256', process.env.ADFLEX_API_KEY)
    .update(req.body)
    .digest('hex');

  // timingSafeEqual ném lỗi khi độ dài khác nhau
  const ok =
    sig.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);

  const dlr = JSON.parse(req.body.toString('utf8'));
  markDelivered(dlr.client_req_id, dlr.delivered_at);
  res.sendStatus(200);
});

@PostMapping(value = "/dlr", consumes = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<String> dlr(
        @RequestBody byte[] rawBody,
        @RequestHeader("X-Zgateway-Signature") String sig) throws Exception {

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(
            System.getenv("ADFLEX_API_KEY").getBytes(StandardCharsets.UTF_8),
            "HmacSHA256"));
    String expected = HexFormat.of().formatHex(mac.doFinal(rawBody));

    if (!MessageDigest.isEqual(
            expected.getBytes(StandardCharsets.UTF_8),
            sig.getBytes(StandardCharsets.UTF_8))) {
        return ResponseEntity.status(401).build();
    }

    Dlr dlr = objectMapper.readValue(rawBody, Dlr.class);
    markDelivered(dlr.clientReqId(), dlr.deliveredAt());
    return ResponseEntity.ok("ok");
}