Naive php web hook endpoint for use in a production environment

Question

Below is the WebHook endpoint in its entirety. I have five seconds to acknowledge if the payload is correctly formed. After that, the payload is inserted into a queue for processing.

Importantly, it works, but it feels naive outside a Class and without any exception handling or error checking beyond the signature match. It does however, achieve exactly what I need.

Should for example, $rawPayload = file_get_contents("php://input"); and $authKey = $_SERVER['HTTP_SIGNATURE']; be inside a try catch block?

Alternatively, should it be threaded in case the endpoint is flooded?

<?php

namespace NJIS\Helpers;

use NJIS\Helpers\XeroWebHookHandler;

$key = $_ENV['XERO_WEBHOOK_KEY'];
$rawPayload = file_get_contents("php://input");
$signature = base64_encode(hash_hmac('sha256', $rawPayload, $key, true));
$authKey = $_SERVER['HTTP_SIGNATURE'];

if($signature === $authKey)
{
    http_response_code(200);
    XeroWebHookHandler::insertPayloadIntoDatabase($rawPayload);
}   
else
{
    http_response_code(401);
}

Answer 1

Only several years late, but since someone bumped the question let's actually answer it. This code does look somewhat reasonable, but it should be programmed more defensively to avoid situations where people can insert anything in your queue.

Handle all possible outputs

hash_hmac can return a string or the boolean false. You pass this directly to base64_encode, which will happily turn false into an empty string.

var_dump(base64_encode(false)); // string(0) ""

Currently, hash_hmac returns false if the algorithm is not supported. If for some reason sha256 is dropped as an algorithm, you can put anything in the queue with an empty signature. Adding an !empty($signature) check to the if-statement will allow the code to fail safely in case something odd is going on.

file_get_contents can return false on failure, and hash_hmac will happily treat this as an empty string for key generation. You could add a sanity check that fails early if you have nothing useful to add to the database.

Exceptions, try and catch

None of your functions seem to throw, except maybe for XeroWebHookHandler::insertPayloadIntoDatabase. This also means that adding a try-catch block does not do anything useful for you. If you have a way of telling if this function fails, you can move http_response_code below this function and potentially return a different response code if the function fails.