Signature Verification

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.WEBHOOK_SECRET;

app.post(
  "/webhooks",
  express.raw({ type: "application/json" }), // keep the raw body
  (req, res) => {
    const received = req.get("X-Webhook-Signature") || "";
    const expected =
      "sha256=" +
      crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");

    const a = Buffer.from(received);
    const b = Buffer.from(expected);
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).send("invalid signature");
    }

    const event = JSON.parse(req.body.toString("utf8"));
    res.sendStatus(200); // ack fast, then process
    handleEvent(event);
  },
);

import hmac
import hashlib
import os
from fastapi import FastAPI, Request, Response

app = FastAPI()
SECRET = os.environ["WEBHOOK_SECRET"].encode()

@app.post("/webhooks")
async def webhooks(request: Request):
    body = await request.body()  # raw bytes
    received = request.headers.get("X-Webhook-Signature", "")
    expected = "sha256=" + hmac.new(SECRET, body, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(received, expected):
        return Response(status_code=401)

    event = await request.json()
    # ack fast, then process out of band
    return Response(status_code=200)