Webhooks & Real-Time Push

Webhook Security - Signature Verification:

// Node.js webhook signature verification
const crypto = require('crypto');

app.post('/webhook/oilpriceapi', (req, res) => {
  const signature = req.headers['x-oilpriceapi-signature'];
  const timestamp = req.headers['x-oilpriceapi-signature-timestamp'];
  const payload = JSON.stringify(req.body);
  
  // Prevent replay attacks (5 minute window)
  if (Date.now() - parseInt(timestamp) > 300000) {
    return res.status(401).send('Timestamp too old');
  }
  
  // Verify signature
  const expectedSig = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(`${payload}.${timestamp}`)
    .digest('hex');
    
  if (signature !== expectedSig) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook
  const { type, data } = req.body;
  
  switch(type) {
    case 'price.updated':
      handlePriceUpdate(data);
      break;
    case 'drilling.rig_count.updated':
      handleRigCountUpdate(data);
      break;
    // ... handle other events
  }
  
  res.status(200).send('OK');
});