Webhooks

import { createHmac, timingSafeEqual } from "crypto"

function verifySignature(
  rawBody: string,
  signature: string | null,
  secret: string
): boolean {
  if (!signature) return false
  const expected = `sha256=${createHmac("sha256", secret).update(rawBody).digest("hex")}`
  if (signature.length !== expected.length) return false
  return timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
}

// Express example
app.post("/webhooks/edpire", express.raw({ type: "application/json" }), (req, res) => {
  const sig = req.headers["x-edpire-signature"] as string
  if (!verifySignature(req.body.toString(), sig, process.env.EDPIRE_WEBHOOK_SECRET!)) {
    return res.sendStatus(401)
  }
  res.sendStatus(200) // respond immediately
  const payload = JSON.parse(req.body.toString())
  // process event...
})

import hmac, hashlib

def verify_signature(raw_body: bytes, signature: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

function verifySignature(string $rawBody, string $signature, string $secret): bool {
    $expected = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);
    return hash_equals($expected, $signature);
}