Authlink.Webhooks 1.0.0

Authlink.Webhooks

Webhook signature validation and event parsing for Authlink webhook integration.

Installation

dotnet add package Authlink.Webhooks

Quick Start

Register services in your application:

using Authlink.Webhooks.Extensions;

// In Program.cs or Startup.cs
services.AddAuthlinkWebhooks();

Usage

Parsing and Validating Webhook Events

using Authlink.Webhooks.Core.Abstractions;
using Authlink.Webhooks.Core.Payloads;

public class WebhookController : ControllerBase
{
    private readonly IWebhookEventParser _parser;

    public WebhookController(IWebhookEventParser parser)
    {
        _parser = parser;
    }

    [HttpPost]
    public async Task<IActionResult> HandleWebhook()
    {
        using var reader = new StreamReader(Request.Body);
        var payload = await reader.ReadToEndAsync();

        var signature = Request.Headers["X-Webhook-Signature"].ToString();
        var timestamp = Request.Headers["X-Webhook-Timestamp"].ToString();
        var secret = Configuration["Webhook:Secret"];

        var result = _parser.ParseAndValidate<RegistrationCompletingPayload>(
            payload, signature, timestamp, secret);

        if (!result.IsSuccess)
        {
            return Unauthorized(result.Error);
        }

        var webhookEvent = result.Event!;
        // Process the event...

        return Ok(WebhookResponseBuilder.Approve());
    }
}

Basic Signature Validation

using Authlink.Webhooks.Core.Abstractions;

public class WebhookHandler
{
    private readonly IWebhookSignatureValidator _validator;

    public WebhookHandler(IWebhookSignatureValidator validator)
    {
        _validator = validator;
    }

    public bool ValidateRequest(string payload, string signature, string timestamp, string secret)
    {
        return _validator.ValidateSignature(payload, signature, timestamp, secret);
    }
}

Parsing Without Validation

using Authlink.Webhooks.Core.Abstractions;
using Authlink.Webhooks.Core.Payloads;

// Parse without signature validation (use with caution)
var result = _parser.Parse<RegistrationCompletingPayload>(jsonPayload);

if (result.IsSuccess)
{
    var webhookEvent = result.Event!;
    Console.WriteLine($"Event Type: {webhookEvent.EventType}");
    Console.WriteLine($"Event ID: {webhookEvent.EventId}");
}

Security

• Uses HMAC-SHA256 for signature computation
• Constant-time comparison to prevent timing attacks
• Signature format: sha256={hex_hash}
• Supports timestamp validation for replay attack prevention

Related Packages

• Authlink.Webhooks.Core - Core types, interfaces, and response models