Verifying Signatures

import crypto from 'crypto';

function verifyWebhook(req, secret) {
  const signature = req.headers['x-bodha-signature'];
  const expected = crypto
    .createHmac('sha256', secret)
    .update(req.rawBody) // use the raw body, not parsed JSON
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex'),
  );
}

// Express example
app.post('/webhooks/bodha', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyWebhook(req, process.env.BODHA_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  console.log(`Received ${event.event}`, event.data);
  res.sendStatus(200);
});

import hmac
import hashlib

def verify_webhook(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# Flask example
@app.route('/webhooks/bodha', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Bodha-Signature', '')
    if not verify_webhook(request.data, signature, WEBHOOK_SECRET):
        return 'Invalid signature', 401

    event = request.get_json()
    print(f"Received {event['event']}", event['data'])
    return '', 200

require 'openssl'

def verify_webhook(payload, signature, secret)
  expected = OpenSSL::HMAC.hexdigest('SHA256', secret, payload)
  Rack::Utils.secure_compare(expected, signature)
end