Callback security

import javax.crypto.Mac
import javax.crypto.spec.SecretKeySpec
import java.util.Base64
import scala.util.Try

def verifyUssdCallback(
    hmacSecret: String,
    timestampHeader: String,
    signatureHeader: String,
    rawBody: String
): Boolean = {
  def hmac(payload: String): String = {
    val mac = Mac.getInstance("HmacSHA256")
    mac.init(new SecretKeySpec(hmacSecret.getBytes("UTF-8"), "HmacSHA256"))
    Base64.getEncoder.encodeToString(mac.doFinal(payload.getBytes("UTF-8")))
  }

  Try {
    val timestamp = timestampHeader.toLong
    val now       = System.currentTimeMillis() / 1000L
    val isFresh   = math.abs(now - timestamp) <= 300
    val expected  = hmac(s"$timestampHeader.$rawBody")
    val received  = signatureHeader.stripPrefix("sha256=")
    isFresh && expected == received
  }.getOrElse(false)
}

import * as crypto from "crypto";

const verifyUssdCallback = (
  hmacSecret: string,
  timestampHeader: string,
  signatureHeader: string,
  rawBody: string,
): boolean => {
  const isFresh = (ts: string): boolean => {
    const t = parseInt(ts, 10);
    return !isNaN(t) && Math.abs(Math.floor(Date.now() / 1000) - t) <= 300;
  };

  const computeHmac = (payload: string): string =>
    crypto
      .createHmac("sha256", hmacSecret)
      .update(payload, "utf8")
      .digest("base64");

  const timingSafeEqual = (a: string, b: string): boolean =>
    a.length === b.length &&
    crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));

  return (
    isFresh(timestampHeader) &&
    timingSafeEqual(
      computeHmac(`${timestampHeader}.${rawBody}`),
      signatureHeader.replace(/^sha256=/, ""),
    )
  );
};

import hmac
import hashlib
import base64
import time

def verify_ussd_callback(
    hmac_secret: str,
    timestamp_header: str,
    signature_header: str,
    raw_body: str,
) -> bool:
    def is_fresh(ts: str) -> bool:
        try:
            return abs(time.time() - int(ts)) <= 300
        except ValueError:
            return False

    def compute_hmac(payload: str) -> str:
        return base64.b64encode(
            hmac.new(
                hmac_secret.encode("utf-8"),
                payload.encode("utf-8"),
                hashlib.sha256,
            ).digest()
        ).decode()

    return is_fresh(timestamp_header) and hmac.compare_digest(
        compute_hmac(f"{timestamp_header}.{raw_body}"),
        signature_header.removeprefix("sha256="),
    )

function verifyUssdCallback(
    string $hmacSecret,
    string $timestampHeader,
    string $signatureHeader,
    string $rawBody
): bool {
    $isFresh = static fn(string $ts): bool =>
        abs(time() - (int) $ts) <= 300;

    $computeHmac = static fn(string $payload): string =>
        base64_encode(hash_hmac('sha256', $payload, $hmacSecret, true));

    return $isFresh($timestampHeader) && hash_equals(
        $computeHmac("{$timestampHeader}.{$rawBody}"),
        preg_replace('/^sha256=/', '', $signatureHeader)
    );
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;
import java.util.Optional;
import java.util.function.Function;
import java.nio.charset.StandardCharsets;

public boolean verifyUssdCallback(
    String hmacSecret,
    String timestampHeader,
    String signatureHeader,
    String rawBody
) {
    Function<String, String> computeHmac = payload -> {
        try {
            var mac = Mac.getInstance("HmacSHA256");
            mac.init(new SecretKeySpec(
                hmacSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"
            ));
            return Base64.getEncoder().encodeToString(
                mac.doFinal(payload.getBytes(StandardCharsets.UTF_8))
            );
        } catch (Exception e) {
            return "";
        }
    };

    try {
        return Optional.of(Long.parseLong(timestampHeader))
            .filter(ts -> Math.abs(System.currentTimeMillis() / 1000L - ts) <= 300)
            .map(__ -> computeHmac.apply(timestampHeader + "." + rawBody))
            .map(expected -> expected.equals(signatureHeader.replaceFirst("^sha256=", "")))
            .orElse(false);
    } catch (NumberFormatException e) {
        return false;
    }
}

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "math"
    "strconv"
    "strings"
    "time"
)

func verifyUssdCallback(
    hmacSecret, timestampHeader, signatureHeader, rawBody string,
) bool {
    isFresh := func(ts string) bool {
        timestamp, err := strconv.ParseInt(ts, 10, 64)
        return err == nil && math.Abs(float64(time.Now().Unix()-timestamp)) <= 300
    }

    computeHmac := func(payload string) string {
        mac := hmac.New(sha256.New, []byte(hmacSecret))
        mac.Write([]byte(payload))
        return base64.StdEncoding.EncodeToString(mac.Sum(nil))
    }

    return isFresh(timestampHeader) && hmac.Equal(
        []byte(computeHmac(timestampHeader+"."+rawBody)),
        []byte(strings.TrimPrefix(signatureHeader, "sha256=")),
    )
}

defmodule UssdCallbackVerifier do
  @max_age_seconds 300

  def verify_callback(hmac_secret, timestamp_header, signature_header, raw_body) do
    with {timestamp, _} <- Integer.parse(timestamp_header),
         true <- fresh?(timestamp) do
      "#{timestamp_header}.#{raw_body}"
      |> compute_hmac(hmac_secret)
      |> Plug.Crypto.secure_compare(String.replace_prefix(signature_header, "sha256=", ""))
    else
      _ -> false
    end
  end

  defp fresh?(timestamp),
    do: abs(System.os_time(:second) - timestamp) <= @max_age_seconds

  defp compute_hmac(payload, secret),
    do: :crypto.mac(:hmac, :sha256, secret, payload) |> Base.encode64()
end

module UssdCallbackVerifier (verifyUssdCallback) where

import Control.Monad                 (guard)
import Control.Monad.IO.Class        (liftIO)
import Control.Monad.Trans.Maybe     (MaybeT (..), runMaybeT)
import Crypto.Hash.Algorithms        (SHA256)
import Crypto.MAC.HMAC               (HMAC, hmac)
import Data.ByteArray.Encoding       (Base (Base64), convertToBase)
import Data.ByteString               (ByteString)
import qualified Data.ByteString.Char8 as BC
import Data.Maybe                    (isJust)
import Data.Time.Clock.POSIX         (getPOSIXTime)

verifyUssdCallback
    :: ByteString  -- ^ USSD HMAC secret
    -> ByteString  -- ^ X-Timestamp header value
    -> ByteString  -- ^ X-Signature header value
    -> ByteString  -- ^ Raw request body
    -> IO Bool
verifyUssdCallback hmacSecret timestampHeader signatureHeader rawBody =
    isJust <$> runMaybeT (do
        now <- liftIO $ round <$> getPOSIXTime
        let timestamp = read (BC.unpack timestampHeader) :: Int
        guard $ abs (now - timestamp) <= 300
        let expected = convertToBase Base64
                         (hmac hmacSecret (timestampHeader <> "." <> rawBody) :: HMAC SHA256)
            received = BC.drop 7 signatureHeader
        guard $ expected == received)