Webhooks

import { Webhook } from "standardwebhooks";

// whsec_… stored in an environment variable
const wh = new Webhook(process.env.WEBHOOK_SECRET);

// rawBody = the request's raw body (string), NOT the already-parsed object
const payload = wh.verify(rawBody, {
  "webhook-id": req.headers["webhook-id"],
  "webhook-timestamp": req.headers["webhook-timestamp"],
  "webhook-signature": req.headers["webhook-signature"],
});
// If the signature doesn't validate, verify() throws — respond 400 and don't process.

import os
from standardwebhooks import Webhook

wh = Webhook(os.environ["WEBHOOK_SECRET"])

# raw_body = the request's raw body (bytes/str), NOT the already-parsed dict
payload = wh.verify(raw_body, {
    "webhook-id": headers["webhook-id"],
    "webhook-timestamp": headers["webhook-timestamp"],
    "webhook-signature": headers["webhook-signature"],
})
# If the signature doesn't validate, verify() throws — respond 400 and don't process.

import crypto from "crypto";

function verifyWebhook(rawBody, headers, secret) {
  const id = headers["webhook-id"];
  const ts = headers["webhook-timestamp"];

  // Reject replays outside ±5 min (the webhook-timestamp is part of the signature).
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(ts)) > 300) return false;

  const signedContent = `${id}.${ts}.${rawBody}`;

  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = crypto.createHmac("sha256", key).update(signedContent).digest("base64");

  // The header may carry several signatures (rotation), space-separated.
  const received = headers["webhook-signature"]
    .split(" ")
    .map((s) => s.replace(/^v1,/, ""));

  return received.some((sig) => {
    const a = Buffer.from(sig);
    const b = Buffer.from(expected);
    return a.length === b.length && crypto.timingSafeEqual(a, b);
  });
}

import base64, hashlib, hmac, time

def verify_webhook(raw_body: str, headers: dict, secret: str) -> bool:
    # Reject replays outside ±5 min (the webhook-timestamp is part of the signature).
    if abs(int(time.time()) - int(headers["webhook-timestamp"])) > 300:
        return False

    signed_content = f'{headers["webhook-id"]}.{headers["webhook-timestamp"]}.{raw_body}'

    key = base64.b64decode(secret.removeprefix("whsec_"))
    expected = base64.b64encode(
        hmac.new(key, signed_content.encode(), hashlib.sha256).digest()
    ).decode()

    # The header may carry several signatures (rotation), space-separated.
    received = [s.removeprefix("v1,") for s in headers["webhook-signature"].split(" ")]
    return any(hmac.compare_digest(sig, expected) for sig in received)