WebhookSigner
AgentPrism.Core.dllProduces and verifies the HMAC-SHA256 signature of webhook requests.
public static class WebhookSignerInheritance
Section titled “Inheritance”Inherited Members
Section titled “Inherited Members”object.GetType(), object.MemberwiseClone(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()
Remarks
Section titled “Remarks”The signature is computed from the string: {timestamp}.{body}. The
timestamp is included in the signature; otherwise a
captured request could be replayed forever.
When verifying the signature, the recipient must also check that the timestamp is within its own tolerance. AgentPrism cannot enforce this; it is documented in the README.
Fields
Section titled “Fields”DeliveryHeader
Section titled “ DeliveryHeader”The header that carries the delivery identity. Used to distinguish duplicate deliveries.
public const string DeliveryHeader = "X-AgentPrism-Delivery"Field Value
Section titled “Field Value”EventHeader
Section titled “ EventHeader”The header that carries the event name.
public const string EventHeader = "X-AgentPrism-Event"Field Value
Section titled “Field Value”SignatureHeader
Section titled “ SignatureHeader”The header that carries the signature.
public const string SignatureHeader = "X-AgentPrism-Signature"Field Value
Section titled “Field Value”TimestampHeader
Section titled “ TimestampHeader”The header that carries the timestamp, in Unix seconds.
public const string TimestampHeader = "X-AgentPrism-Timestamp"Field Value
Section titled “Field Value”Methods
Section titled “Methods”IsReservedHeader(string?)
Section titled “ IsReservedHeader(string?)”Reports whether a header name is one AgentPrism sets itself.
public static bool IsReservedHeader(string? name)Parameters
Section titled “Parameters”name string?
The header name to check.
Returns
Section titled “Returns”true if the name is reserved.
Remarks
Section titled “Remarks”A subscription’s extra headers are administrator input. Letting one of them carry a reserved name would append a second value to a header the recipient verifies, which the recipient cannot resolve.
Sign(string, DateTimeOffset, string)
Section titled “ Sign(string, DateTimeOffset, string)”Produces a signature for a body and timestamp.
public static string Sign(string body, DateTimeOffset timestamp, string secret)Parameters
Section titled “Parameters”body string
The JSON body to send.
timestamp DateTimeOffset
The request’s timestamp.
secret string
The signing secret.
Returns
Section titled “Returns”The signature, in the form sha256=<hex>.
Exceptions
Section titled “Exceptions”secret is empty.
Verify(string, DateTimeOffset, string, string?)
Section titled “ Verify(string, DateTimeOffset, string, string?)”Verifies a signature.
public static bool Verify(string body, DateTimeOffset timestamp, string secret, string? signature)Parameters
Section titled “Parameters”body string
The received body.
timestamp DateTimeOffset
The timestamp in the request.
secret string
The signing secret.
signature string?
The signature in the request.
Returns
Section titled “Returns”true if the signature is valid.
Remarks
Section titled “Remarks”The comparison is constant-time, using
CryptographicOperations.FixedTimeEquals:
an ordinary string comparison would let the signature be guessed byte
by byte from the time taken until the first differing byte.