Answering Calls

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

const TOLERANCE_SECONDS = 300;

function verifySentSignature(headers, rawBody, secret) {
  const id = headers['x-webhook-id'];
  const timestamp = headers['x-webhook-timestamp'];
  const signature = headers['x-webhook-signature'];
  if (!id || !timestamp || !signature) return false;

  const skew = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
  if (!Number.isFinite(skew) || skew > TOLERANCE_SECONDS) return false;

  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = createHmac('sha256', key).update(`${id}.${timestamp}.${rawBody}`).digest();

  return signature
    .split(/\s+/)
    .filter((part) => part.startsWith('v1,'))
    .some((part) => {
      const provided = Buffer.from(part.slice(3), 'base64');
      return provided.length === expected.length && timingSafeEqual(provided, expected);
    });
}

const app = express();

// Raw body: the signature covers the bytes as sent, so do not use express.json() on this route
app.post('/voice/callback', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body.toString('utf8');
  const question = JSON.parse(rawBody);
  const secret = secretForNumber(question.number); // the callback secret of that voice number

  if (!verifySentSignature(req.headers, rawBody, secret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  res.json({ action: { action: 'connectToUser', identity: 'agent-42' } });
});

import base64, hashlib, hmac, time
from flask import Flask, request, jsonify

TOLERANCE_SECONDS = 300

def verify_sent_signature(headers, raw_body: bytes, secret: str) -> bool:
    webhook_id = headers.get("X-Webhook-ID")
    timestamp = headers.get("X-Webhook-Timestamp")
    signature = headers.get("X-Webhook-Signature")
    if not webhook_id or not timestamp or not signature:
        return False
    try:
        skew = abs(int(time.time()) - int(timestamp))
    except ValueError:
        return False
    if skew > TOLERANCE_SECONDS:
        return False

    key = base64.b64decode(secret.removeprefix("whsec_"))
    signed = f"{webhook_id}.{timestamp}.".encode() + raw_body
    expected = hmac.new(key, signed, hashlib.sha256).digest()

    for part in signature.split():
        if not part.startswith("v1,"):
            continue
        try:
            provided = base64.b64decode(part[3:])
        except ValueError:
            continue
        if hmac.compare_digest(provided, expected):
            return True
    return False

app = Flask(__name__)

@app.post("/voice/callback")
def voice_callback():
    raw_body = request.get_data()  # the bytes as sent, before any parsing
    question = request.get_json(force=True)
    secret = secret_for_number(question["number"])  # the callback secret of that voice number

    if not verify_sent_signature(request.headers, raw_body, secret):
        return jsonify(error="Invalid signature"), 401

    return jsonify(action={"action": "connectToUser", "identity": "agent-42"})

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "encoding/json"
    "io"
    "math"
    "net/http"
    "strconv"
    "strings"
    "time"
)

const toleranceSeconds = 300

func verifySentSignature(h http.Header, rawBody []byte, secret string) bool {
    id := h.Get("X-Webhook-ID")
    timestamp := h.Get("X-Webhook-Timestamp")
    signature := h.Get("X-Webhook-Signature")
    if id == "" || timestamp == "" || signature == "" {
        return false
    }
    ts, err := strconv.ParseInt(timestamp, 10, 64)
    if err != nil || math.Abs(float64(time.Now().Unix()-ts)) > toleranceSeconds {
        return false
    }

    key, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(secret, "whsec_"))
    if err != nil {
        return false
    }
    mac := hmac.New(sha256.New, key)
    mac.Write([]byte(id + "." + timestamp + "."))
    mac.Write(rawBody)
    expected := mac.Sum(nil)

    for _, part := range strings.Fields(signature) {
        if !strings.HasPrefix(part, "v1,") {
            continue
        }
        provided, err := base64.StdEncoding.DecodeString(part[3:])
        if err == nil && hmac.Equal(provided, expected) {
            return true
        }
    }
    return false
}

func voiceCallback(w http.ResponseWriter, r *http.Request) {
    rawBody, _ := io.ReadAll(r.Body) // the bytes as sent, before any parsing
    var question struct {
        Number string `json:"number"`
    }
    _ = json.Unmarshal(rawBody, &question)
    secret := secretForNumber(question.Number) // the callback secret of that voice number

    if !verifySentSignature(r.Header, rawBody, secret) {
        http.Error(w, `{"error":"Invalid signature"}`, http.StatusUnauthorized)
        return
    }

    w.Header().Set("Content-Type", "application/json")
    w.Write([]byte(`{"action":{"action":"connectToUser","identity":"agent-42"}}`))
}

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

const int ToleranceSeconds = 300;

static bool VerifySentSignature(IHeaderDictionary headers, string rawBody, string secret)
{
    string? id = headers["X-Webhook-ID"];
    string? timestamp = headers["X-Webhook-Timestamp"];
    string? signature = headers["X-Webhook-Signature"];
    if (string.IsNullOrEmpty(id) || string.IsNullOrEmpty(timestamp) || string.IsNullOrEmpty(signature))
        return false;

    if (!long.TryParse(timestamp, out var ts)
        || Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - ts) > ToleranceSeconds)
        return false;

    var key = Convert.FromBase64String(secret.StartsWith("whsec_") ? secret["whsec_".Length..] : secret);
    var expected = HMACSHA256.HashData(key, Encoding.UTF8.GetBytes($"{id}.{timestamp}.{rawBody}"));

    foreach (var part in signature.Split(' ', StringSplitOptions.RemoveEmptyEntries))
    {
        if (!part.StartsWith("v1,")) continue;
        byte[] provided;
        try { provided = Convert.FromBase64String(part[3..]); } catch (FormatException) { continue; }
        if (CryptographicOperations.FixedTimeEquals(provided, expected)) return true;
    }
    return false;
}

app.MapPost("/voice/callback", async (HttpRequest request) =>
{
    using var reader = new StreamReader(request.Body);
    var rawBody = await reader.ReadToEndAsync(); // the body as sent, before any parsing
    var number = JsonDocument.Parse(rawBody).RootElement.GetProperty("number").GetString();
    var secret = SecretForNumber(number); // the callback secret of that voice number

    if (!VerifySentSignature(request.Headers, rawBody, secret))
        return Results.Json(new { error = "Invalid signature" }, statusCode: 401);

    return Results.Json(new { action = new { action = "connectToUser", identity = "agent-42" } });
});

<?php
const TOLERANCE_SECONDS = 300;

function verifySentSignature(array $headers, string $rawBody, string $secret): bool
{
    $id = $headers['X-Webhook-ID'] ?? '';
    $timestamp = $headers['X-Webhook-Timestamp'] ?? '';
    $signature = $headers['X-Webhook-Signature'] ?? '';
    if ($id === '' || $timestamp === '' || $signature === '') {
        return false;
    }
    if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > TOLERANCE_SECONDS) {
        return false;
    }

    $encoded = str_starts_with($secret, 'whsec_') ? substr($secret, 6) : $secret;
    $key = base64_decode($encoded, true);
    if ($key === false) {
        return false;
    }
    $expected = hash_hmac('sha256', "$id.$timestamp.$rawBody", $key, true);

    foreach (preg_split('/\s+/', $signature) as $part) {
        if (!str_starts_with($part, 'v1,')) {
            continue;
        }
        $provided = base64_decode(substr($part, 3), true);
        if ($provided !== false && hash_equals($expected, $provided)) {
            return true;
        }
    }
    return false;
}

$rawBody = file_get_contents('php://input'); // the body as sent, before any parsing
$question = json_decode($rawBody, true);
$secret = secretForNumber($question['number']); // the callback secret of that voice number

$headers = [
    'X-Webhook-ID' => $_SERVER['HTTP_X_WEBHOOK_ID'] ?? '',
    'X-Webhook-Timestamp' => $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '',
    'X-Webhook-Signature' => $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '',
];

if (!verifySentSignature($headers, $rawBody, $secret)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

header('Content-Type: application/json');
echo json_encode(['action' => ['action' => 'connectToUser', 'identity' => 'agent-42']]);