Validating Webhook Signatures

const crypto = require('crypto');
const fs = require('fs');

// Load the public key (Ensure this key is securely stored and only accessible to your application)
const publicKey = fs.readFileSync('path/to/public-key.pem', 'utf8');

/**
 * Validate webhook payload signature using RSA public key.
 * @param {Object} payload - The webhook payload
 * @param {string} receivedSignature - The signature from 'X-Signature' header, encoded in base64
 * @returns {boolean} - Returns true if the signature is valid
 */
function validateWebhookPayload(payload, receivedSignature) {
  const payloadString = JSON.stringify(payload);
  
  const verify = crypto.createVerify('RSA-SHA256');
  verify.update(payloadString);
  verify.end();
  
  return verify.verify(publicKey, receivedSignature, 'base64');
}

// Example usage
const receivedPayload = { event: 'call_finished', callId: '12345', status: 'completed' };
const receivedSignature = 'base64-encoded-signature-from-header';

const isValid = validateWebhookPayload(receivedPayload, receivedSignature);

console.log(isValid ? 'Valid Signature' : 'Invalid Signature');

import base64
from Crypto.PublicKey import RSA
from Crypto.Signature import pkcs1_15
from Crypto.Hash import SHA256

def validate_webhook_signature(raw_body: bytes, signature_b64: str, public_key_path: str) -> bool:
    """
    Validate a Callers webhook payload signature using the RSA public key.

    :param raw_body: Raw bytes of the webhook request body (exactly as received)
    :param signature_b64: Signature from the 'X-Signature' header (base64-encoded)
    :param public_key_path: Path to the Callers public key PEM file
    :return: True if the signature is valid, False otherwise
    """
    # Load the public key
    with open(public_key_path, "rb") as f:
        public_key = RSA.import_key(f.read())

    # Calculate hash of the raw body and verify signature
    try:
        pkcs1_15.new(public_key).verify(SHA256.new(raw_body), base64.b64decode(signature_b64))
        return True
    except Exception:
        return False


# Example usage

# Raw webhook payload (as bytes)
raw_webhook_body = b'{"event":"call_finished","callId":"12345","status":"completed"}'

# Signature from 'X-Signature' header (base64-encoded)
received_signature = "base64-encoded-signature-from-header"

# Path to Callers public key PEM file
public_key_file = "path/to/public-key.pem"

# Validate the signature
is_valid = validate_webhook_signature(raw_webhook_body, received_signature, public_key_file)

print(is_valid)
print("Valid Signature" if is_valid else "Invalid Signature")