<?php
$payload   = $_POST['payload'];   // raw string
$signature = $_POST['signature']; // hex digest

$parsed = json_decode($payload, true);

// 1. Prevent Replay Attacks (5-minute expiration)
$age_ms = abs(time() * 1000 - $parsed['timestamp']);
if ($age_ms > 5 * 60 * 1000) {
    http_response_code(403);
    die('Expired Token');
}

// 2. Verify HMAC-SHA256 Signature
$expected = hash_hmac('sha256', $payload, $_ENV['TAPHUMAN_SECRET_KEY']);

if (!hash_equals($expected, $signature)) {
    http_response_code(403);
    die('Invalid Signature');
}

// 3. Verified — proceed with form submission
echo json_encode(['success' => true]);

import hmac, hashlib, json, time, os
from flask import request, jsonify

@app.route('/api/verify-captcha', methods=['POST'])
def verify_captcha():
    payload   = request.form['payload']   # raw string
    signature = request.form['signature'] # hex digest
    parsed    = json.loads(payload)

    # 1. Prevent Replay Attacks (5-minute expiration)
    age_ms = abs(time.time() * 1000 - parsed['timestamp'])
    if age_ms > 5 * 60 * 1000:
        return 'Expired Token', 403

    # 2. Verify HMAC-SHA256 Signature
    expected = hmac.new(
        os.environ['TAPHUMAN_SECRET_KEY'].encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        return 'Invalid Signature', 403

    # 3. Verified — proceed with form submission
    return jsonify(success=True)