drjones/pest-nocturne
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add HMAC webhook verification + SSL fix

Browse Source
This commit is contained in:
drjones
2026-09-01 01:38:58 -07:00
parent f9242710eb
commit 0d5252cf4f
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app.py
View File

@@ -12,6 +12,7 @@ BTCPAY_URL = os.environ.get("BTCPAY_URL", "https://10.30.20.140")
BTCPAY_STORE = os.environ.get("BTCPAY_STORE", "FDT6DHWEaA7DF5WFePkp4pufgQ9yy1G6JfzTCwey1jYn") BTCPAY_STORE = os.environ.get("BTCPAY_STORE", "FDT6DHWEaA7DF5WFePkp4pufgQ9yy1G6JfzTCwey1jYn")
BTCPAY_KEY = os.environ.get("BTCPAY_KEY", "206f08d0a8efc4cfbe524188756c5bd1b2fd277a") BTCPAY_KEY = os.environ.get("BTCPAY_KEY", "206f08d0a8efc4cfbe524188756c5bd1b2fd277a")
PRICE_USD = os.environ.get("PRICE_USD", "5.00") PRICE_USD = os.environ.get("PRICE_USD", "5.00")
WEBHOOK_SECRET = os.environ.get("WEBHOOK_SECRET", "pn-nocturne-webhook-secret-1788251891")
app = Flask(__name__) app = Flask(__name__)
@@ -73,6 +74,10 @@ def unlock():
@app.route("/webhook/btcpay", methods=["POST"]) @app.route("/webhook/btcpay", methods=["POST"])
def webhook(): def webhook():
raw = request.get_data() raw = request.get_data()
sig = request.headers.get("BTCPay-Sig", "")
exp = "sha256=" + hmac.new(WEBHOOK_SECRET.encode(), raw, hashlib.sha256).hexdigest()
if not hmac.compare_digest(exp, sig):
return "bad sig", 401
data = json.loads(raw) if raw else {} data = json.loads(raw) if raw else {}
etype = data.get("type", "") etype = data.get("type", "")
order_id = (data.get("metadata") or {}).get("orderId") order_id = (data.get("metadata") or {}).get("orderId")