Fix Insecure Webhooks in CodeIgniter

public function handleWebhook() {
    // VULNERABLE: Direct consumption of input without verification
    $data = $this->request->getJSON(true);
// Attacker can spoof this payload to mark any order as paid
$orderId = $data['order_id'];
$this->orderModel->update($orderId, ['status' => 'completed']);

return $this->response->setStatusCode(200);
}

public function handleWebhook() {
    $secret = env('WEBHOOK_SECRET');
    $signature = $this->request->getHeaderLine('X-Hub-Signature-256');
    $payload = $this->request->getBody();
if (empty($signature)) {
    return $this->failUnauthorized('No signature provided');
}

// Compute HMAC SHA256 using the raw request body
$expectedSignature = 'sha256=' . hash_hmac('sha256', $payload, $secret);

// Use hash_equals to mitigate timing attacks
if (!hash_equals($expectedSignature, $signature)) {
    log_message('critical', '[SECURITY] Webhook signature mismatch from ' . $this->request->getIPAddress());
    return $this->failUnauthorized('Invalid signature');
}

$data = json_decode($payload, true);
$this->orderModel->update($data['order_id'], ['status' => 'completed']);

return $this->response->setStatusCode(200);
}