Lead webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

// The RAW body, not a re-serialised object. JSON.stringify(req.body)
// reorders nothing today and may tomorrow; either way the bytes differ.
export function verify(rawBody, headers, secret) {
  const timestamp = headers["x-whiz-timestamp"];
  const signature = headers["x-whiz-signature"];
  if (!timestamp || !signature) return false;

  // Reject anything older than five minutes.
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(age) || age > 300) return false;

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(signature, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

import hashlib, hmac, time

def verify(raw_body: bytes, headers, secret: str) -> bool:
    timestamp = headers.get("X-Whiz-Timestamp")
    signature = headers.get("X-Whiz-Signature")
    if not timestamp or not signature:
        return False

    if abs(time.time() - int(timestamp)) > 300:
        return False

    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.".encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()

    # compare_digest, never ==: a plain comparison leaks the answer by timing.
    return hmac.compare_digest(expected, signature)

require "openssl"

def verify(raw_body, headers, secret)
  timestamp = headers["X-Whiz-Timestamp"]
  signature = headers["X-Whiz-Signature"]
  return false unless timestamp && signature
  return false if (Time.now.to_i - timestamp.to_i).abs > 300

  # Note the argument order: key first, then data.
  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}.#{raw_body}")

  OpenSSL.secure_compare(expected, signature)
end

<?php
function verify(string $rawBody, array $headers, string $secret): bool {
    $timestamp = $headers['X-Whiz-Timestamp'] ?? null;
    $signature = $headers['X-Whiz-Signature'] ?? null;
    if (!$timestamp || !$signature) return false;
    if (abs(time() - (int) $timestamp) > 300) return false;

    // Note the argument order: data first, then the key.
    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

    return hash_equals($expected, $signature);
}