Verifying deliveries

X-Signature: t=1785283200,v1=7e4306381ed67b399b28fe307a71749c9bd38dfbbf83a38f4755af6cc08eff5a

1785283200.{"id":"evt_test","name":"ping","created_at":"2026-07-29T00:00:00Z","data":{}}

const { createHmac, timingSafeEqual } = require('node:crypto')

const REPLAY_WINDOW_SECONDS = 300

function verify(secret, rawBody, signatureHeader) {
  const parts = new Map()
  for (const segment of String(signatureHeader).split(',')) {
    const index = segment.indexOf('=')
    if (index === -1) continue
    parts.set(segment.slice(0, index).trim(), segment.slice(index + 1).trim())
  }

  const t = parts.get('t')
  const v1 = parts.get('v1')
  if (!t || !/^\d{1,10}$/.test(t)) return false
  if (!v1 || !/^[0-9a-f]{64}$/.test(v1)) return false

  const now = Math.floor(Date.now() / 1000)
  // Written as a negated `<=` rather than `>` so a non-finite clock rejects instead of
  // silently disabling replay protection: NaN comparisons are always false, so `>` would
  // let anything through, while `!(NaN <= WINDOW)` is true.
  if (!(Math.abs(now - Number(t)) <= REPLAY_WINDOW_SECONDS)) return false

  // Two updates rather than one template string, so a Buffer body is hashed as its own bytes
  // instead of being stringified first.
  const mac = createHmac('sha256', secret)
  mac.update(`${t}.`)
  mac.update(rawBody)

  return timingSafeEqual(mac.digest(), Buffer.from(v1, 'hex'))
}

module.exports = { verify }

import hashlib
import hmac
import re
import time

REPLAY_WINDOW_SECONDS = 300

T_PATTERN = re.compile(r"^\d{1,10}$")
V1_PATTERN = re.compile(r"^[0-9a-f]{64}$")


def verify(secret: str, raw_body: bytes, signature_header: str) -> bool:
    parts = {}
    for segment in signature_header.split(","):
        key, sep, value = segment.partition("=")
        if sep:
            parts[key.strip()] = value.strip()

    t = parts.get("t", "")
    v1 = parts.get("v1", "")
    if not T_PATTERN.match(t) or not V1_PATTERN.match(v1):
        return False

    if abs(int(time.time()) - int(t)) > REPLAY_WINDOW_SECONDS:
        return False

    expected = hmac.new(
        secret.encode("utf-8"), f"{t}.".encode("utf-8") + raw_body, hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(expected, v1)

package webhooks

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"regexp"
	"strconv"
	"strings"
	"time"
)

const replayWindowSeconds = 300

var (
	tPattern  = regexp.MustCompile(`^\d{1,10}$`)
	v1Pattern = regexp.MustCompile(`^[0-9a-f]{64}$`)
)

func Verify(secret string, rawBody []byte, signatureHeader string) bool {
	var t, v1 string
	for _, segment := range strings.Split(signatureHeader, ",") {
		key, value, found := strings.Cut(segment, "=")
		if !found {
			continue
		}
		switch strings.TrimSpace(key) {
		case "t":
			t = strings.TrimSpace(value)
		case "v1":
			v1 = strings.TrimSpace(value)
		}
	}

	if !tPattern.MatchString(t) || !v1Pattern.MatchString(v1) {
		return false
	}

	sent, err := strconv.ParseInt(t, 10, 64)
	if err != nil {
		return false
	}
	if delta := time.Now().Unix() - sent; delta > replayWindowSeconds || delta < -replayWindowSeconds {
		return false
	}

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(t + "."))
	mac.Write(rawBody)

	provided, err := hex.DecodeString(v1)
	if err != nil {
		return false
	}

	return hmac.Equal(mac.Sum(nil), provided)
}