Affiliate Postback URLs

$secret = getenv('EF_AFFILIATE_POSTBACK_SECRET');
$payload = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_EF_TIMESTAMP'] ?? '';
$received = $_SERVER['HTTP_X_EF_SIGNATURE'] ?? '';

if (abs(time() - (int)$timestamp) > 300) {
    http_response_code(400);
    exit('Timestamp too old');
}

$expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $payload, $secret);

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit('Bad signature');
}

$event = json_decode($payload, true);
// process $event...
http_response_code(200);
echo 'ok';

import crypto from 'node:crypto';

app.post('/webhooks/affiliate', express.raw({ type: 'application/json' }), (req, res) => {
  const secret = process.env.EF_AFFILIATE_POSTBACK_SECRET;
  const ts = req.get('X-EF-Timestamp') || '';
  const sig = req.get('X-EF-Signature') || '';

  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) {
    return res.status(400).send('Timestamp too old');
  }

  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(`${ts}.${req.body.toString()}`)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig))) {
    return res.status(401).send('Bad signature');
  }

  const event = JSON.parse(req.body.toString());
  // process event...
  res.sendStatus(200);
});

import hmac, hashlib, time, json
from flask import Flask, request, abort

SECRET = os.environ['EF_AFFILIATE_POSTBACK_SECRET'].encode()

@app.post('/webhooks/affiliate')
def webhook():
    body = request.get_data()
    ts = request.headers.get('X-EF-Timestamp', '')
    sig = request.headers.get('X-EF-Signature', '')

    if abs(time.time() - int(ts)) > 300:
        abort(400, 'Timestamp too old')

    expected = 'sha256=' + hmac.new(SECRET, f'{ts}.'.encode() + body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        abort(401, 'Bad signature')

    event = json.loads(body)
    # process event...
    return '', 200