Signature Verification

import { createHmac, timingSafeEqual } from "crypto";

function verifyWebhook(
  rawBody: string,
  timestampHeader: string, // X-Render-Timestamp
  signatureHeader: string, // X-Render-Signature, e.g. "sha256=a4b3c2d1..."
  secret: string,
  toleranceSeconds = 300
): boolean {
  const timestamp = parseInt(timestampHeader, 10);

  if (Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) {
    throw new Error("Webhook timestamp out of tolerance");
  }

  const received = signatureHeader.replace(/^sha256=/, "");
  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(received);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

import hashlib
import hmac
import time


def verify_webhook(
    raw_body: bytes,
    timestamp_header: str,  # X-Render-Timestamp
    signature_header: str,  # X-Render-Signature, e.g. "sha256=a4b3c2d1..."
    secret: str,
    tolerance_seconds: int = 300,
) -> bool:
    timestamp = int(timestamp_header)

    if abs(time.time() - timestamp) > tolerance_seconds:
        raise ValueError("Webhook timestamp out of tolerance")

    received = signature_header.removeprefix("sha256=")
    payload = f"{timestamp}.{raw_body.decode()}".encode()
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()

    return hmac.compare_digest(received, expected)