Verify webhook signatures

import crypto from "node:crypto";
import express from "express";

const app = express();

app.post("/hooks/pawabase", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("Pawabase-Signature") ?? "";
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return res.sendStatus(403);

  const expected = crypto.createHmac("sha256", process.env.WEBHOOK_SECRET!).update(`${t}.`).update(req.body).digest("hex");
  const given = Buffer.from(parts.v1 ?? "", "hex");
  const want = Buffer.from(expected, "hex");
  if (given.length !== want.length || !crypto.timingSafeEqual(given, want)) return res.sendStatus(403);

  const event = JSON.parse(req.body.toString());
  // handle event.event / event.data; ignore a repeated event.id
  res.sendStatus(200);
});

import hashlib, hmac, json, os, time
from fastapi import FastAPI, HTTPException, Request

app = FastAPI()

def verify(body: bytes, header: str, secret: str) -> bool:
    parts = dict(item.split("=", 1) for item in header.split(",") if "=" in item)
    try:
        stamp = int(parts.get("t", ""))
    except ValueError:
        return False
    if abs(time.time() - stamp) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{stamp}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))

@app.post("/hooks/pawabase")
async def hook(request: Request):
    body = await request.body()
    if not verify(body, request.headers.get("Pawabase-Signature", ""), os.environ["WEBHOOK_SECRET"]):
        raise HTTPException(status_code=403)
    return {"ok": True}