<?phpnamespace AppHttpMiddleware;use Closure;
use IlluminateHttpResponse;class ValidateMailgunWebhook
{public function handle($request, Closure $next){if (!$request->isMethod('post')) {abort(Response::HTTP_FORBIDDEN, 'Only POST requests are allowed.');}if ($this->verify($request)) {return $next($request);}abort(Response::HTTP_FORBIDDEN, 'The webhook signature was invalid.');}protected function buildSignature($request){return hash_hmac('sha256',sprintf('%s%s', $request->input('timestamp'), $request->input('token')),config('services.mailgun.secret'));}protected function verify($request){if (abs(time() - $request->input('timestamp')) > 15) {return false;}return $this->buildSignature($request) === $request->input('signature');}
}

$ laravel new middleware-tests# 切换到 middleware-tests 文件夹
$ cd $_$ php artisan make:middleware ValidateMailgunWebhook

protected $routeMiddleware = [// ...'mailgun.webhook' => AppHttpMiddlewareValidateMailgunWebhook::class,
];

$ php artisan make:test SecureMailgunWebhookTest

<?phpnamespace TestsFeature;use TestsTestCase;
use SymfonyComponentHttpFoundationResponse;
use SymfonyComponentHttpKernelExceptionHttpException;class SecureMailgunWebhookTest extends TestCase
{protected function setUp(){parent::setUp();config()->set('services.mailgun.secret', 'secret');Route::middleware('mailgun.webhook')->any('/_test/webhook', function () {return 'OK';});}/** @test */public function it_forbids_non_post_methods(){$this->withoutExceptionHandling();$exceptionCount = 0;$httpVerbs = ['get', 'put', 'patch', 'delete'];foreach ($httpVerbs as $httpVerb) {try {$response = $this->$httpVerb('/_test/webhook');} catch (HttpException $e) {$exceptionCount++;$this->assertEquals(Response::HTTP_FORBIDDEN, $e->getStatusCode());$this->assertEquals('Only POST requests are allowed.', $e->getMessage());}}if (count($httpVerbs) === $exceptionCount) {return;}$this->fail('Expected a 403 forbidden');}
}

# Run all tests in the file
$ ./vendor/bin/phpunit tests/Feature/SecureMailgunWebhookTest.php# Filter a specific method
$ ./vendor/bin/phpunit tests/Feature/SecureMailgunWebhookTest.php --filter=it_forbids_non_post_methods

/** @test */
public function it_aborts_with_an_invalid_signature()
{$this->withoutExceptionHandling();try {$this->post('/_test/webhook', ['timestamp' => abs(time() - 100),'token' => 'invalid-token','signature' => 'invalid-signature',]);} catch (HttpException $e) {$this->assertEquals(Response::HTTP_FORBIDDEN, $e->getStatusCode());$this->assertEquals('The webhook signature was invalid.', $e->getMessage());return;}$this->fail('Expected the webhook signature to be invalid.');
}

if ($this->verify($request)) {return $next($request);
}

/** @test */
public function it_passes_with_a_valid_signature()
{$this->withoutExceptionHandling();$timestamp = time();$token = 'token';$response = $this->post('/_test/webhook', ['timestamp' => $timestamp,'token' => $token,'signature' => $this->buildSignature($timestamp, $token),]);$this->assertEquals('OK', $response->getContent());
}protected function buildSignature($timestamp, $token)
{return hash_hmac('sha256',sprintf('%s%s', $timestamp, $token),config('services.mailgun.secret'));
}

/** @test */
public function it_fails_with_an_old_timestamp()
{try {$this->withoutExceptionHandling();$timestamp = abs(time() - 16);$token = 'token';$response = $this->post('/_test/webhook', ['timestamp' => $timestamp,'token' => $token,'signature' => $this->buildSignature($timestamp, $token),]);} catch (HttpException $e) {$this->assertEquals(Response::HTTP_FORBIDDEN, $e->getStatusCode());$this->assertEquals('The webhook signature was invalid.', $e->getMessage());return;}$this->fail('The timestamp should have failed verification.');
}