Unicode C Requires Chilkat v11.5.0+
Unicode C
Box: Verify a Captured V2 Webhook Signature
See more Box Examples
Verify raw payload bytes and captured headers using the configured primary and secondary signing keys. The example rejects stale/future timestamps and compares randomized HMACs of the signatures to avoid exposing a signature-prefix timing comparison. It does not host an HTTP listener. The receiver must persist/deduplicate the verified event and acknowledge promptly.
See the Box API guide for setup and the complete workflow.
Chilkat Unicode C Downloads
#include <C_CkBinDataW.h>
#include <C_CkDateTimeW.h>
#include <C_CkCrypt2W.h>
#include <C_CkPrngW.h>
#include <C_CkJsonObjectW.h>
void ChilkatSample(void)
{
BOOL success;
HCkBinDataW rawBody;
const wchar_t *timestamp;
const wchar_t *primarySignature;
const wchar_t *secondarySignature;
const wchar_t *signatureVersion;
const wchar_t *signatureAlgorithm;
const wchar_t *primaryKey;
const wchar_t *secondaryKey;
HCkDateTimeW delivered;
HCkDateTimeW now;
int age;
HCkBinDataW signedBytes;
HCkCrypt2W mac;
const wchar_t *expectedPrimary;
const wchar_t *expectedSecondary;
HCkPrngW random;
const wchar_t *comparisonKey;
const wchar_t *pExpected;
const wchar_t *pReceived;
const wchar_t *sExpected;
const wchar_t *sReceived;
BOOL validPrimary;
BOOL validSecondary;
HCkJsonObjectW webhookEvent;
success = FALSE;
// Requires Chilkat 11.5.0 or later and a previously unlocked Chilkat bundle.
// See Global Unlock Sample.
// Guide: Box API Guide.
success = FALSE;
// Save the exact HTTP body bytes to this file, without JSON reserialization.
rawBody = CkBinDataW_Create();
success = CkBinDataW_LoadFile(rawBody,L"qa_data/box_webhook_body.bin");
if (success != TRUE) {
wprintf(L"%s\n",CkBinDataW_lastErrorText(rawBody));
CkBinDataW_Dispose(rawBody);
return;
}
// Read these fields case-insensitively from the incoming request headers.
// For this offline example, enter the captured header values.
timestamp = L"BOX_DELIVERY_TIMESTAMP";
primarySignature = L"BOX_SIGNATURE_PRIMARY";
secondarySignature = L"BOX_SIGNATURE_SECONDARY";
signatureVersion = L"1";
signatureAlgorithm = L"HmacSHA256";
// Retrieve configured keys from protected application configuration.
primaryKey = L"BOX_PRIMARY_SIGNATURE_KEY";
secondaryKey = L"BOX_SECONDARY_SIGNATURE_KEY";
if ((signatureVersion != L"1") || (signatureAlgorithm != L"HmacSHA256")) {
wprintf(L"Unsupported signature version or algorithm.\n");
CkBinDataW_Dispose(rawBody);
return;
}
delivered = CkDateTimeW_Create();
success = CkDateTimeW_SetFromTimestamp(delivered,timestamp);
if (success != TRUE) {
wprintf(L"%s\n",CkDateTimeW_lastErrorText(delivered));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
return;
}
now = CkDateTimeW_Create();
success = CkDateTimeW_SetFromCurrentSystemTime(now);
if (success != TRUE) {
wprintf(L"%s\n",CkDateTimeW_lastErrorText(now));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
return;
}
age = wcstol(CkDateTimeW_GetAsUnixTime(now,FALSE)) - wcstol(CkDateTimeW_GetAsUnixTime(delivered,FALSE));
// Box recommends rejecting deliveries older than ten minutes.
// Allow at most 60 seconds of future clock skew; keep the server clock synchronized.
if ((age > 600) || (age < -60)) {
wprintf(L"Delivery timestamp is outside the accepted window.\n");
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
return;
}
signedBytes = CkBinDataW_Create();
success = CkBinDataW_AppendBd(signedBytes,rawBody);
if (success != TRUE) {
wprintf(L"%s\n",CkBinDataW_lastErrorText(signedBytes));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
return;
}
success = CkBinDataW_AppendString(signedBytes,timestamp,L"utf-8");
if (success != TRUE) {
wprintf(L"%s\n",CkBinDataW_lastErrorText(signedBytes));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
return;
}
mac = CkCrypt2W_Create();
CkCrypt2W_putMacAlgorithm(mac,L"hmac");
CkCrypt2W_putHashAlgorithm(mac,L"sha256");
CkCrypt2W_putEncodingMode(mac,L"base64");
success = CkCrypt2W_SetMacKeyString(mac,primaryKey);
if (success != TRUE) {
wprintf(L"%s\n",CkCrypt2W_lastErrorText(mac));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
return;
}
expectedPrimary = CkCrypt2W_macBdENC(mac,signedBytes);
if (CkCrypt2W_getLastMethodSuccess(mac) != TRUE) {
wprintf(L"%s\n",CkCrypt2W_lastErrorText(mac));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
return;
}
success = CkCrypt2W_SetMacKeyString(mac,secondaryKey);
if (success != TRUE) {
wprintf(L"%s\n",CkCrypt2W_lastErrorText(mac));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
return;
}
expectedSecondary = CkCrypt2W_macBdENC(mac,signedBytes);
if (CkCrypt2W_getLastMethodSuccess(mac) != TRUE) {
wprintf(L"%s\n",CkCrypt2W_lastErrorText(mac));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
return;
}
// Blind both sides with a fresh secret random key before equality comparison.
// Never compare the original HMAC strings using a prefix-short-circuit comparison.
// A host-language receiver can instead use its standard constant-time byte comparison.
random = CkPrngW_Create();
comparisonKey = CkPrngW_genRandom(random,32,L"base64");
if (CkPrngW_getLastMethodSuccess(random) != TRUE) {
wprintf(L"%s\n",CkPrngW_lastErrorText(random));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
CkPrngW_Dispose(random);
return;
}
success = CkCrypt2W_SetMacKeyEncoded(mac,comparisonKey,L"base64");
if (success != TRUE) {
wprintf(L"%s\n",CkCrypt2W_lastErrorText(mac));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
CkPrngW_Dispose(random);
return;
}
pExpected = CkCrypt2W_macStringENC(mac,expectedPrimary);
if (CkCrypt2W_getLastMethodSuccess(mac) != TRUE) {
wprintf(L"%s\n",CkCrypt2W_lastErrorText(mac));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
CkPrngW_Dispose(random);
return;
}
pReceived = CkCrypt2W_macStringENC(mac,primarySignature);
if (CkCrypt2W_getLastMethodSuccess(mac) != TRUE) {
wprintf(L"%s\n",CkCrypt2W_lastErrorText(mac));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
CkPrngW_Dispose(random);
return;
}
sExpected = CkCrypt2W_macStringENC(mac,expectedSecondary);
if (CkCrypt2W_getLastMethodSuccess(mac) != TRUE) {
wprintf(L"%s\n",CkCrypt2W_lastErrorText(mac));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
CkPrngW_Dispose(random);
return;
}
sReceived = CkCrypt2W_macStringENC(mac,secondarySignature);
if (CkCrypt2W_getLastMethodSuccess(mac) != TRUE) {
wprintf(L"%s\n",CkCrypt2W_lastErrorText(mac));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
CkPrngW_Dispose(random);
return;
}
validPrimary = (primaryKey != L"") && (primarySignature != L"") && (pExpected == pReceived);
validSecondary = (secondaryKey != L"") && (secondarySignature != L"") && (sExpected == sReceived);
if ((validPrimary == FALSE) && (validSecondary == FALSE)) {
wprintf(L"Signature verification failed.\n");
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
CkPrngW_Dispose(random);
return;
}
// Parse JSON only after signature verification.
webhookEvent = CkJsonObjectW_Create();
success = CkJsonObjectW_Load(webhookEvent,CkBinDataW_getString(rawBody,L"utf-8"));
if (success != TRUE) {
wprintf(L"%s\n",CkJsonObjectW_lastErrorText(webhookEvent));
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
CkPrngW_Dispose(random);
CkJsonObjectW_Dispose(webhookEvent);
return;
}
wprintf(L"Verified event ID: %s\n",CkJsonObjectW_stringOf(webhookEvent,L"id"));
wprintf(L"Trigger: %s\n",CkJsonObjectW_stringOf(webhookEvent,L"trigger"));
// Deduplicate using event.id, not BOX-DELIVERY-ID, which changes on retries.
// Verify the target belongs to your configured webhook before dispatching work.
CkBinDataW_Dispose(rawBody);
CkDateTimeW_Dispose(delivered);
CkDateTimeW_Dispose(now);
CkBinDataW_Dispose(signedBytes);
CkCrypt2W_Dispose(mac);
CkPrngW_Dispose(random);
CkJsonObjectW_Dispose(webhookEvent);
}