Below is the WebHook endpoint in its entirety. I have five seconds to acknowledge if the payload is correctly formed. After that, the payload is inserted into a queue for processing.
Importantly, it works, but it feels naive outside a Class and without any exception handling or error checking beyond the signature match. It does however, achieve exactly what I need.
Should for example, $rawPayload = file_get_contents("php://input");
and $authKey = $_SERVER['HTTP_SIGNATURE'];
be inside a try
catch
block?
Alternatively, should it be threaded in case the endpoint is flooded?
<?php
namespace NJIS\Helpers;
use NJIS\Helpers\XeroWebHookHandler;
$key = $_ENV['XERO_WEBHOOK_KEY'];
$rawPayload = file_get_contents("php://input");
$signature = base64_encode(hash_hmac('sha256', $rawPayload, $key, true));
$authKey = $_SERVER['HTTP_SIGNATURE'];
if($signature === $authKey)
{
http_response_code(200);
XeroWebHookHandler::insertPayloadIntoDatabase($rawPayload);
}
else
{
http_response_code(401);
}