Technical Developer Walkthrough

# fakeexpedia/backend/app/middleware/hmac_verify.py

import hashlib, hmac, time
from fastapi import Request, Response

SHARED_SECRET = os.environ["PAYFENCE_HMAC_SECRET"]
MAX_AGE = 300  # 5 minutes

async def verify_hmac(request: Request, call_next):
    sig_header = request.headers.get("x-payfence-signature", "")
    timestamp  = request.headers.get("x-payfence-timestamp", "")
    request_id = request.headers.get("x-payfence-request-id", "")

    # Reject stale requests
    if abs(time.time() - int(timestamp)) > MAX_AGE:
        return Response(status_code=403, ...)

    # Build canonical string
    body_hash = hashlib.sha256(await request.body()).hexdigest()
    canonical = f"{request.method}\n{request.url.path}?{request.url.query}\n"
    canonical += f"{timestamp}\n{request_id}\n{body_hash}"

    # Compute expected HMAC
    expected = hmac.new(
        SHARED_SECRET.encode(), canonical.encode(), hashlib.sha256
    ).hexdigest()

    # Timing-safe comparison
    if not hmac.compare_digest(f"v1={expected}", sig_header):
        return Response(status_code=403,
            content='{"error":"origin_protection_failed"}')

    return await call_next(request)