Webhooks

def verify_webhook_signature(request_body, signature_header, secret)
  parts = signature_header.split(',').map { |p| p.split('=').last }
  timestamp = parts[0]
  signature = parts[1]

  signed_payload = "#{timestamp}.#{request_body}"
  computed = OpenSSL::HMAC.hexdigest('SHA256', secret, signed_payload)

  computed == signature
end

import hmac
import hashlib

def verify_webhook_signature(request_body, signature_header, secret):
    parts = signature_header.split(',')
    timestamp = parts[0].split('=')[1]
    signature = parts[1].split('=')[1]

    signed_payload = f"{timestamp}.{request_body}"
    computed = hmac.new(
        secret.encode('utf-8'),
        signed_payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(computed, signature)

function verifyWebhookSignature(string $requestBody, string $signatureHeader, string $secret): bool
{
    $parts = explode(',', $signatureHeader);
    $timestamp = explode('=', $parts[0])[1];
    $signature = explode('=', $parts[1])[1];

    $signedPayload = "{$timestamp}.{$requestBody}";
    $computed = hash_hmac('sha256', $signedPayload, $secret);

    return hash_equals($computed, $signature);
}

const crypto = require('crypto');

function verifyWebhookSignature(requestBody, signatureHeader, secret) {
  const parts = signatureHeader.split(',');
  const timestamp = parts[0].split('=')[1];
  const signature = parts[1].split('=')[1];

  const signedPayload = `${timestamp}.${requestBody}`;
  const computed = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(computed),
    Buffer.from(signature)
  );
}