Verifying signatures

import crypto from "crypto";

function verifyWebhookSignature(request, secret) {
  const webhookId = request.headers["webhook-id"];
  const timestamp = request.headers["webhook-timestamp"];
  const signature = request.headers["webhook-signature"];
  const body = request.rawBody; // raw request body as string

  // Check timestamp is within 5 minutes
  const now = Math.floor(Date.now() / 1000);
  const diff = Math.abs(now - parseInt(timestamp));
  if (diff > 300) {
    throw new Error("Webhook timestamp too old");
  }

  // Strip the whsec_ prefix from your secret
  const signingKey = Buffer.from(secret.replace("whsec_", ""), "base64");

  // Construct base string and compute HMAC
  const baseString = `${webhookId}.${timestamp}.${body}`;
  const expected = crypto
    .createHmac("sha256", signingKey)
    .update(baseString)
    .digest("base64");

  // Extract signature value (after "v1,")
  const received = signature.split(",")[1];

  // Constant-time comparison
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))) {
    throw new Error("Invalid webhook signature");
  }

  return JSON.parse(body);
}

import hmac
import hashlib
import base64
import time

def verify_webhook_signature(headers: dict, body: str, secret: str):
    webhook_id = headers["webhook-id"]
    timestamp = headers["webhook-timestamp"]
    signature = headers["webhook-signature"]

    # Check timestamp is within 5 minutes
    now = int(time.time())
    if abs(now - int(timestamp)) > 300:
        raise ValueError("Webhook timestamp too old")

    # Strip the whsec_ prefix
    signing_key = base64.b64decode(secret.removeprefix("whsec_"))

    # Construct base string and compute HMAC
    base_string = f"{webhook_id}.{timestamp}.{body}"
    expected = base64.b64encode(
        hmac.new(signing_key, base_string.encode(), hashlib.sha256).digest()
    ).decode()

    # Extract signature value (after "v1,")
    received = signature.split(",")[1]

    # Constant-time comparison
    if not hmac.compare_digest(expected, received):
        raise ValueError("Invalid webhook signature")

    return True