Webhooks

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300

def verify(raw_body: bytes, signature: str, timestamp: str, secret: str) -> bool:
    # Reject anything too old to be a live delivery, before spending a comparison on it.
    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        return False

    message = timestamp.encode() + b"." + raw_body
    expected = "v1=" + hmac.new(
        secret.encode(), message, hashlib.sha256
    ).hexdigest()

    # Constant time, so a timing difference cannot leak the digest.
    return hmac.compare_digest(expected, signature)

import { createHmac, timingSafeEqual } from 'node:crypto';

const TOLERANCE_SECONDS = 300;

export function verify(
  rawBody: Buffer,
  signature: string,
  timestamp: string,
  secret: string,
): boolean {
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) {
    return false;
  }

  const message = Buffer.concat([Buffer.from(`${timestamp}.`), rawBody]);
  const expected = `v1=${createHmac('sha256', secret).update(message).digest('hex')}`;

  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}