Push feed.

import express from "express";
import bodyParser from "body-parser";
import crypto from "crypto";

const HMAC_ALGORITHM = "sha256";
const HMAC_ENCODING = "hex";

// The authenticity token, found on the selected channel page.
// Assumed that it is set as an enviroment variable,
// which is recommended, as the token is considered a secret.
const HMAC_SECRET = process.env.SECRET_TOKEN;

// Recommended as messages can get quite large
// (Especially the nightly full sync message)
app.use(bodyParser.json({ limit: "50mb" }));

// Webhook endpoint - receives push feed requests from Stager
app.post("/stager-feed", (req, res) => {
  // Prepare required data
  const body = req.body;
  const bodyString = JSON.stringify(body);
  const stagerSignature = req.header("X-Signature");

  // Create Hmac object, generate control signature
  hmacObject = crypto.createHmac(HMAC_ALGORITHM, HMAC_SECRET);
  hmacObject.update(bodyString);
  const controlSignature = hmacObject.digest(HMAC_ENCODING);

  // Verify signature provided by Stager
  if (stagerSignature === controlSignature) {
    // Signature valid, message is safe to process

    // ...

    // Close connection with a 200 response
    res.status(200).send("Request received and message processed!");
  } else {
    // Signature invalid, message ignored
    // Close connection with a 401 response
    res.status(401).send("Request validation failed!");
  }
});

package controllers

import javax.crypto.Mac
import javax.crypto.spec.SecretKeySpec
import org.apache.commons.codec.binary.Hex
import play.mvc.Controller
import play.mvc.NoAuthenticityToken
import play.mvc.results.Forbidden
import play.mvc.results.Ok
import play.mvc.results.Result

// The authentication token, found in the Stager Backstage
// Assumed that it is set as an environment variable 
// named "authenticationToken"
// This is recommended, as the token is considered a secret
const val AUTHENTICATION_TOKEN_NAME = "authenticationToken"

const val HMAC_ALGORITHM = "HmacSHA256"
const val SIGNATURE_HEADER = "X-Signature"

class StagerFeedRequestHandler : Controller() {
  @NoAuthenticityToken
  fun handle(): Result {
    val body = request.body
    val bodyBytes = body.readAllBytes()

    val headers = request.headers
    val stagerSignature = headers[SIGNATURE_HEADER]?.value()

    // Verify signature provided by Stager
    return if (validateSignature(bodyBytes, stagerSignature)) {
      // Signature valid, message is safe to process

      // ...

      Ok() // Close connection with a 200 response
    } else {
      // Signature invalid, message ignored
      // Close connection with a 403 response
      Forbidden("Request validation failed!")
    }
  }

  private fun validateSignature(
    body: ByteArray, 
    signature: String?
  ): Boolean {
    // Check whether signature is present
    return signature?.let { // Signature present, verify

      // Construct SecretKeySpec object from the authentication token
      val secretKeyEnvVar = System.getenv(AUTHENTICATION_TOKEN_NAME)
      val secretKeyBytes = Hex.decodeHex(secretKeyEnvVar.toCharArray())
      val secretKey = SecretKeySpec(secretKeyBytes, HMAC_ALGORITHM)

      // Create and initiate the Mac instance
      val hmacInstance = Mac.getInstance(HMAC_ALGORITHM)
      hmacInstance.init(secretKey)

      // Generate control signature and the Stager signature against it
      val controlSignature = hmacInstance.doFinal(body)
      return controlSignature.contentEquals(secretKeyBytes)
    } ?: run {
      false // Signature missing, default to invalid
    }
  }
}