Trust but Verify the Webhook

Trust but Verify the Webhook

Your extension exposes an endpoint that an e-commerce platform calls with order events. Anyone who can reach that endpoint can POST a body — the only thing separating a genuine event from a forged or tampered one is the signature header. You and the platform share a secret; for every request the platform computes an HMAC-SHA256 digest of the raw payload text, keyed with that secret, and sends it hex-encoded in a header. Your job is the verifier that decides, before any processing, whether a body can be trusted.

Requirements

Create a codeunit named "Webhook Signature Verifier" with one public procedure:

procedure VerifySignature(Payload: Text; Secret: Text; SignatureHeader: Text): Boolean

Rules:

1. A signature entry has the form sha256=<hex digest>, where <hex digest> is the 64-character hexadecimal encoding of the HMAC-SHA256 of Payload keyed with Secret. VerifySignature returns true exactly when the header proves the payload is untouched.
2. To support secret rotation, SignatureHeader may carry several entries separated by commas, e.g. sha256=aaa..., sha256=bbb...; spaces around an entry are ignored. Return true if at least one sha256= entry carries the correct digest.