Webhooks

import crypto from "node:crypto";
import express from "express";

const app = express();
const WEBHOOK_SECRET = process.env.VORT_WEBHOOK_SECRET; // from Vort, out of band

// express.raw keeps req.body as the exact bytes received. Do NOT put
// express.json() in front of this route: it would parse and discard the raw body.
app.post("/webhooks/vort", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("x-vort-signature") || "";
  const expected =
    "sha256=" + crypto.createHmac("sha256", WEBHOOK_SECRET).update(req.body).digest("hex");

  const a = Buffer.from(header.trim().toLowerCase(), "utf8");
  const b = Buffer.from(expected, "utf8");
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).end();
  }

  const evt = JSON.parse(req.body.toString("utf8")); // parse only AFTER verifying
  res.status(204).end();                              // acknowledge fast
  queueVortEvent(evt);                                // dedupe on evt.event_id, then GET /runs/{run_id} async
});

import hashlib
import hmac
import json
import os

from flask import Flask, abort, request

app = Flask(__name__)
WEBHOOK_SECRET = os.environ["VORT_WEBHOOK_SECRET"].encode()  # from Vort, out of band


@app.post("/webhooks/vort")
def vort_webhook():
    raw = request.get_data()  # exact raw bytes; do not read request.json before verifying
    header = request.headers.get("x-vort-signature", "").strip().lower()
    expected = "sha256=" + hmac.new(WEBHOOK_SECRET, raw, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(header, expected):  # constant-time compare
        abort(401)

    event = json.loads(raw)   # parse only AFTER verifying
    queue_vort_event(event)   # dedupe on event_id, then GET /runs/{run_id} async
    return "", 204            # acknowledge fast

<?php
// routes/api.php  (api routes are not CSRF-protected; if you use routes/web.php,
// exclude this path from CSRF verification)
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

Route::post('/webhooks/vort', function (Request $request) {
    $raw    = $request->getContent();                       // exact raw bytes
    $header = strtolower(trim((string) $request->header('x-vort-signature', '')));
    $secret = config('services.vort.webhook_secret');       // from Vort, out of band

    $expected = 'sha256=' . hash_hmac('sha256', $raw, $secret);

    if (!hash_equals($expected, $header)) {                 // constant-time compare
        return response()->noContent(401);
    }

    // Parse only AFTER verifying. Do not use $request->all()/json() before this point
    // and never re-encode the payload to verify it.
    $event = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
    \App\Jobs\HandleVortEvent::dispatch($event);            // dedupe on event_id, then GET /runs/{run_id}
    return response()->noContent();                         // 204, fast
});