Webhook Security

import crypto from "crypto";

function verifyWebhook({ timestamp, eventType, rawBody, signature, secret }) {
  const bodyHash = crypto.createHash("sha256").update(rawBody).digest("hex");
  const signingPayload = `${timestamp}.${eventType}.${bodyHash}`;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signingPayload)
    .digest("hex");

  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

import hashlib
import hmac

def verify_webhook(timestamp: str, event_type: str, raw_body: bytes, signature: str, secret: str) -> bool:
    body_hash = hashlib.sha256(raw_body).hexdigest()
    signing_payload = f"{timestamp}.{event_type}.{body_hash}".encode("utf-8")
    expected = hmac.new(secret.encode("utf-8"), signing_payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)