Webhooks

import hmac
import hashlib
import time

def verify_webhook(payload: bytes, signature_header: str, webhook_secret: str) -> bool:
    # Parse the signature header
    parts = dict(part.split("=") for part in signature_header.split(","))
    timestamp = parts["t"]
    expected_signature = parts["v1"]

    # Reject if timestamp is too old (5 minute tolerance)
    if abs(time.time() - int(timestamp)) > 300:
        return False

    # Compute expected signature
    signed_payload = f"{timestamp}.{payload.decode()}"
    computed = hmac.new(
        webhook_secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(computed, expected_signature)

const crypto = require('crypto');

function verifyWebhook(payload, signatureHeader, webhookSecret) {
  // Parse the signature header
  const parts = Object.fromEntries(
    signatureHeader.split(',').map(part => part.split('='))
  );
  const timestamp = parts.t;
  const expectedSignature = parts.v1;

  // Reject if timestamp is too old (5 minute tolerance)
  if (Math.abs(Date.now() / 1000 - parseInt(timestamp)) > 300) {
    return false;
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${payload}`;
  const computed = crypto
    .createHmac('sha256', webhookSecret)
    .update(signedPayload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(computed),
    Buffer.from(expectedSignature)
  );
}