Webhook delivery

import { createHmac, timingSafeEqual } from "node:crypto";

const TOLERANCE_SECONDS = 300;

export function verifyDelivery(rawBody, headers, secret) {
  const timestamp = headers["x-webhook-timestamp"];
  const signature = headers["x-signature"];
  if (!timestamp || !signature) return false;

  // Reject deliveries signed too long ago to be a live request.
  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
  if (!Number.isFinite(age) || age > TOLERANCE_SECONDS) return false;

  const digest = createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  const expected = Buffer.from(`sha256=${digest}`);
  const received = Buffer.from(signature);

  return expected.length === received.length && timingSafeEqual(expected, received);
}

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300

def verify_delivery(raw_body: bytes, headers: dict, secret: str) -> bool:
    timestamp = headers.get("x-webhook-timestamp")
    signature = headers.get("x-signature")
    if not timestamp or not signature:
        return False

    # Reject deliveries signed too long ago to be a live request.
    if abs(int(time.time()) - int(timestamp)) > TOLERANCE_SECONDS:
        return False

    mac = hmac.new(secret.encode(), f"{timestamp}.".encode() + raw_body, hashlib.sha256)
    expected = f"sha256={mac.hexdigest()}"

    return hmac.compare_digest(expected, signature)