Webhook verification

import crypto from "node:crypto";

function verify(secret, timestamp, rawBody, signature) {
  if (Math.abs(Number(timestamp) - Date.now()) > 300_000) return false;
  const message = Buffer.concat([Buffer.from(timestamp), rawBody]);
  const expected = crypto.createHmac("sha256", secret).update(message).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

import hmac
import hashlib
import time

def verify(secret: str, timestamp: str, raw_body: bytes, signature: str) -> bool:
    if abs(int(timestamp) - int(time.time() * 1000)) > 300_000:
        return False
    message = timestamp.encode() + raw_body
    expected = hmac.new(secret.encode(), message, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;

public final class WebhookVerifier {
  private static final long MAX_SKEW_MS = 300_000L;

  public static boolean verify(String secret, String timestamp, byte[] rawBody, String signature)
      throws Exception {
    long ts = Long.parseLong(timestamp);
    if (Math.abs(ts - System.currentTimeMillis()) > MAX_SKEW_MS) {
      return false;
    }

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));

    byte[] tsBytes = timestamp.getBytes(StandardCharsets.UTF_8);
    byte[] message = new byte[tsBytes.length + rawBody.length];
    System.arraycopy(tsBytes, 0, message, 0, tsBytes.length);
    System.arraycopy(rawBody, 0, message, tsBytes.length, rawBody.length);

    String expected = toHex(mac.doFinal(message));
    return MessageDigest.isEqual(
        expected.getBytes(StandardCharsets.UTF_8),
        signature.getBytes(StandardCharsets.UTF_8));
  }

  private static String toHex(byte[] bytes) {
    StringBuilder sb = new StringBuilder(bytes.length * 2);
    for (byte b : bytes) {
      sb.append(String.format("%02x", b));
    }
    return sb.toString();
  }
}