Webhooks

const crypto = require('crypto');

function verifyWebhook(payload, headers, secret) {
  const msgId = headers['webhook-id'];
  const msgTimestamp = headers['webhook-timestamp'];
  const msgSignature = headers['webhook-signature'];

  // Check timestamp is within 5 minutes
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(msgTimestamp)) > 300) {
    throw new Error('Timestamp too old');
  }

  // Construct signed payload
  const signedPayload = `${msgId}.${msgTimestamp}.${payload}`;

  // Compute signature
  const secretBytes = Buffer.from(secret.replace('whsec_', ''), 'base64');
  const expectedSignature = crypto
    .createHmac('sha256', secretBytes)
    .update(signedPayload)
    .digest('base64');

  // Extract v1 signature
  const signatures = msgSignature.split(' ');
  for (const sig of signatures) {
    const [version, signature] = sig.split(',');
    if (version === 'v1' && signature === expectedSignature) {
      return true;
    }
  }

  throw new Error('Invalid signature');
}

import hmac
import hashlib
import base64
import time

def verify_webhook(payload: str, headers: dict, secret: str) -> bool:
    msg_id = headers.get('webhook-id')
    msg_timestamp = headers.get('webhook-timestamp')
    msg_signature = headers.get('webhook-signature')

    # Check timestamp is within 5 minutes
    now = int(time.time())
    if abs(now - int(msg_timestamp)) > 300:
        raise ValueError('Timestamp too old')

    # Construct signed payload
    signed_payload = f"{msg_id}.{msg_timestamp}.{payload}"

    # Compute signature
    secret_bytes = base64.b64decode(secret.replace('whsec_', ''))
    expected_signature = base64.b64encode(
        hmac.new(secret_bytes, signed_payload.encode(), hashlib.sha256).digest()
    ).decode()

    # Extract v1 signature
    for sig in msg_signature.split(' '):
        version, signature = sig.split(',')
        if version == 'v1' and signature == expected_signature:
            return True

    raise ValueError('Invalid signature')

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "errors"
    "fmt"
    "math"
    "strconv"
    "strings"
    "time"
)

func VerifyWebhook(payload string, headers map[string]string, secret string) error {
    msgID := headers["webhook-id"]
    msgTimestamp := headers["webhook-timestamp"]
    msgSignature := headers["webhook-signature"]

    // Check timestamp is within 5 minutes
    ts, _ := strconv.ParseInt(msgTimestamp, 10, 64)
    now := time.Now().Unix()
    if math.Abs(float64(now-ts)) > 300 {
        return errors.New("timestamp too old")
    }

    // Construct signed payload
    signedPayload := fmt.Sprintf("%s.%s.%s", msgID, msgTimestamp, payload)

    // Compute signature
    secretBytes, _ := base64.StdEncoding.DecodeString(strings.TrimPrefix(secret, "whsec_"))
    h := hmac.New(sha256.New, secretBytes)
    h.Write([]byte(signedPayload))
    expectedSig := base64.StdEncoding.EncodeToString(h.Sum(nil))

    // Extract v1 signature
    for _, sig := range strings.Split(msgSignature, " ") {
        parts := strings.SplitN(sig, ",", 2)
        if len(parts) == 2 && parts[0] == "v1" && parts[1] == expectedSig {
            return nil
        }
    }

    return errors.New("invalid signature")
}

<?php

function verifyWebhook(string $payload, array $headers, string $secret): bool {
    $msgId = $headers['webhook-id'] ?? '';
    $msgTimestamp = $headers['webhook-timestamp'] ?? '';
    $msgSignature = $headers['webhook-signature'] ?? '';

    // Check timestamp is within 5 minutes
    $now = time();
    if (abs($now - (int)$msgTimestamp) > 300) {
        throw new Exception('Timestamp too old');
    }

    // Construct signed payload
    $signedPayload = "{$msgId}.{$msgTimestamp}.{$payload}";

    // Compute signature
    $secretBytes = base64_decode(str_replace('whsec_', '', $secret));
    $expectedSignature = base64_encode(
        hash_hmac('sha256', $signedPayload, $secretBytes, true)
    );

    // Extract v1 signature
    foreach (explode(' ', $msgSignature) as $sig) {
        [$version, $signature] = explode(',', $sig, 2);
        if ($version === 'v1' && $signature === $expectedSignature) {
            return true;
        }
    }

    throw new Exception('Invalid signature');
}