Verify signatures

# pip install standardwebhooks
from standardwebhooks import Webhook

# The secret returned when the subscription was created, e.g. "whsec_..."
secret = "YOUR_WEBHOOK_SIGNING_SECRET"

def handle_request(raw_body: bytes, headers: dict):
    wh = Webhook(secret)
    # Raises an error if the signature or timestamp is invalid.
    payload = wh.verify(raw_body, {
        "webhook-id": headers["webhook-id"],
        "webhook-timestamp": headers["webhook-timestamp"],
        "webhook-signature": headers["webhook-signature"],
    })
    # payload is the verified, parsed event.
    return payload

// npm install standardwebhooks
import { Webhook } from "standardwebhooks";

// The secret returned when the subscription was created, e.g. "whsec_..."
const secret = "YOUR_WEBHOOK_SIGNING_SECRET";

function handleRequest(rawBody, headers) {
  const wh = new Webhook(secret);
  // Throws if the signature or timestamp is invalid.
  const payload = wh.verify(rawBody, {
    "webhook-id": headers["webhook-id"],
    "webhook-timestamp": headers["webhook-timestamp"],
    "webhook-signature": headers["webhook-signature"],
  });
  // payload is the verified, parsed event.
  return payload;
}

import base64
import hashlib
import hmac

def verify(raw_body: bytes, headers: dict, secret: str) -> bool:
    webhook_id = headers["webhook-id"]
    timestamp = headers["webhook-timestamp"]

    signed_content = f"{webhook_id}.{timestamp}.{raw_body.decode('utf-8')}"
    key = base64.b64decode(secret.removeprefix("whsec_"))
    digest = hmac.new(key, signed_content.encode("utf-8"), hashlib.sha256).digest()
    expected = base64.b64encode(digest).decode("utf-8")

    # The header may contain multiple space-delimited signatures.
    for part in headers["webhook-signature"].split(" "):
        version, _, value = part.partition(",")
        if version == "v1" and hmac.compare_digest(value, expected):
            return True
    return False

import crypto from "crypto";

function verify(rawBody, headers, secret) {
  const webhookId = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];

  const signedContent = `${webhookId}.${timestamp}.${rawBody}`;
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = crypto
    .createHmac("sha256", key)
    .update(signedContent)
    .digest("base64");

  // The header may contain multiple space-delimited signatures.
  return headers["webhook-signature"].split(" ").some((part) => {
    const [version, value] = part.split(",");
    return (
      version === "v1" &&
      value.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(value), Buffer.from(expected))
    );
  });
}