Webhook security

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyWebhook(rawBody, timestamp, signatureHeader, secret, now = Date.now()) {
  if (!secret || !Buffer.isBuffer(rawBody)) return false;
  if (typeof timestamp !== 'string' || !/^\d{1,12}$/.test(timestamp)) return false;
  if (Math.abs(Math.floor(now / 1000) - Number(timestamp)) > 300) return false;
  if (typeof signatureHeader !== 'string') return false;
  const expected = createHmac('sha256', secret)
    .update(timestamp + '.')
    .update(rawBody)
    .digest();
  return signatureHeader.split(',').some((entry) => {
    const match = /^v1=([a-f0-9]{64})$/.exec(entry.trim());
    return match !== null && timingSafeEqual(expected, Buffer.from(match[1], 'hex'));
  });
}

import hashlib
import hmac
import re
import time

def verify_webhook(raw_body, timestamp, signature_header, secret, now=None):
    if not secret or not isinstance(raw_body, bytes):
        return False
    if not isinstance(timestamp, str) or not re.fullmatch(r"[0-9]{1,12}", timestamp):
        return False
    current = time.time() if now is None else now
    if abs(int(current) - int(timestamp)) > 300:
        return False
    if not isinstance(signature_header, str):
        return False
    expected = hmac.new(secret.encode("utf-8"),
                        timestamp.encode("ascii") + b"." + raw_body,
                        hashlib.sha256).hexdigest()
    return any(re.fullmatch(r"v1=[a-f0-9]{64}", entry.strip())
               and hmac.compare_digest(expected, entry.strip()[3:])
               for entry in signature_header.split(","))