Webhook security

import crypto from "node:crypto";

// rawBody: the exact request body bytes/string (before any JSON parsing).
// webhookId: the value from the X-Webhook-Id header.
export function isValidSignature(rawBody, signatureHeader, webhookId) {
  const expected = crypto
    .createHmac("sha256", webhookId)
    .update(rawBody, "utf8")
    .digest("hex");
  const received = (signatureHeader || "").replace(/^sha256=/, "");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(received, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hmac, hashlib

def is_valid_signature(raw_body: bytes, signature_header: str, webhook_id: str) -> bool:
    expected = hmac.new(webhook_id.encode(), raw_body, hashlib.sha256).hexdigest()
    received = (signature_header or "").removeprefix("sha256=")
    return hmac.compare_digest(expected, received)

// Reject deliveries older than 5 minutes.
export function isWithinWindow(tsHeader, windowMs = 5 * 60 * 1000) {
  const ts = parseInt(tsHeader || "0", 10);
  return Math.abs(Date.now() - ts) <= windowMs;
}

import time

def is_within_window(ts_header: str, window_ms: int = 5 * 60 * 1000) -> bool:
    ts = int(ts_header or 0)
    return abs(int(time.time() * 1000) - ts) <= window_ms