const express = require('express');
const crypto = require('crypto');
const app = express();

// RAW Body parsing required (for HMAC verification)
app.use(express.raw({ type: 'application/json' }));

const API_KEY = 'YOUR_TRONMON_API_KEY';

app.post('/webhook', (req, res) => {
    const receivedSignature = req.headers['x-signature'] || '';
    const rawInput = req.body.toString('utf-8');

    // Compute HMAC-SHA256
    const computedSignature = crypto
        .createHmac('sha256', API_KEY)
        .update(rawInput)
        .digest('hex');

    // Safe comparison against timing attacks
    const isSignatureValid = crypto.timingSafeEqual(
        Buffer.from(computedSignature),
        Buffer.from(receivedSignature)
    );

    if (isSignatureValid) {
        const payload = JSON.parse(rawInput);
        
        // Business Logic
        console.log('[TRONMON] Webhook Received:', payload);

        return res.status(200).json({ status: 'success' });
    } else {
        return res.status(401).json({ status: 'error', message: 'Invalid Signature' });
    }
});

app.listen(3000, () => console.log('Server running on port 3000'));

import hmac
import hashlib
import json
from fastapi import FastAPI, Request, HTTPException, Header
from fastapi.responses import JSONResponse

app = FastAPI()
API_KEY = "YOUR_TRONMON_API_KEY"

@app.post("/webhook")
async def webhook_receiver(request: Request, x_signature: str = Header(None)):
    raw_body = await request.body()
    
    # Compute HMAC-SHA256
    computed_signature = hmac.new(
        API_KEY.encode('utf-8'),
        raw_body,
        hashlib.sha256
    ).hexdigest()

    # Safe comparison against timing attacks
    if x_signature and hmac.compare_digest(computed_signature, x_signature):
        payload = json.loads(raw_body.decode('utf-8'))
        
        # Business Logic
        print("[TRONMON] Webhook Received:", payload)

        return JSONResponse(status_code=200, content={"status": "success"})
    else:
        raise HTTPException(status_code=401, detail="Invalid Signature")

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"net/http"
)

const apiKey = "YOUR_TRONMON_API_KEY"

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	receivedSignature := r.Header.Get("X-Signature")
	rawBody, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "Bad Request", http.StatusBadRequest)
		return
	}

	// Compute HMAC-SHA256
	mac := hmac.New(sha256.New, []byte(apiKey))
	mac.Write(rawBody)
	computedSignature := hex.EncodeToString(mac.Sum(nil))

	// Safe comparison against timing attacks
	if hmac.Equal([]byte(computedSignature), []byte(receivedSignature)) {
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusOK)
		w.Write([]byte(`{"status":"success"}`))
	} else {
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusUnauthorized)
		w.Write([]byte(`{"status":"error","message":"Invalid Signature"}`))
	}
}

func main() {
	http.HandleFunc("/webhook", webhookHandler)
	http.ListenAndServe(":8080", nil)
}