To ensure a request comes from Ticketlayer, verify the Ticketlayer-Signature header using the signing secret provided during endpoint registration.
Verification Logic:
- The signature is an HMAC-SHA256 of the string
"<t>.<raw body>" (where <t> is the timestamp from the header), hex encoded. - Reject deliveries where the timestamp
t is more than five minutes (300 seconds) from the current time. - Crucial: Compute the HMAC over the raw request body before any JSON parsing.
Implementation Example (Node.js/Express):
import crypto from 'node:crypto';
export function verifyTicketlayerSignature(rawBody: string, header: string, secret: string, toleranceSeconds = 300): boolean {
const parts = Object.fromEntries(header.split(',').map((kv) => kv.split('=').map((s) => s.trim())));
const t = Number(parts.t);
const v1 = parts.v1;
if (!t || !v1) return false;
if (Math.abs(Math.floor(Date.now() / 1000) - t) > toleranceSeconds) return false;
const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
const a = Buffer.from(v1, 'hex');
const b = Buffer.from(expected, 'hex');
return a.length === b.length && crypto.timingSafeEqual(a, b);
}
// Express usage
app.post('/webhooks/ticketlayer', express.raw({ type: 'application/json' }), (req, res) => {
const raw = req.body.toString('utf8');
if (!verifyTicketlayerSignature(raw, req.get('Ticketlayer-Signature') ?? '', process.env.TL_WEBHOOK_SECRET!)) {
return res.status(400).send('bad signature');
}
const envelope = JSON.parse(raw);
if (envelope.type === 'order.confirmed') {
// handle order.confirmed
}
res.sendStatus(204);
});
