Webhooks

import crypto from 'crypto'

function verify(secret: string, headers: Record<string,string>, body: string): boolean {
  const sig = headers['x-sf-signature']
  if (!sig) return false
  const [tPart, vPart] = sig.split(',')
  const t = tPart.split('=')[1]
  const v1 = vPart.split('=')[1]
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${body}`)
    .digest('hex')
  if (Math.abs(Date.now()/1000 - Number(t)) > 300) return false  // 5min window
  return crypto.timingSafeEqual(Buffer.from(v1, 'hex'), Buffer.from(expected, 'hex'))
}

import hmac, hashlib, time

def verify(secret: str, headers: dict, body: str) -> bool:
    sig = headers.get("x-sf-signature", "")
    if not sig:
        return False
    parts = dict(p.split("=") for p in sig.split(","))
    t, v1 = parts["t"], parts["v1"]
    if abs(int(time.time()) - int(t)) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{t}.{body}".encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(v1, expected)

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "strings"
    "time"
)

func verify(secret string, headers map[string]string, body string) bool {
    sig := headers["x-sf-signature"]
    parts := strings.Split(sig, ",")
    if len(parts) != 2 { return false }
    t := strings.TrimPrefix(parts[0], "t=")
    v1 := strings.TrimPrefix(parts[1], "v1=")
    ts, _ := time.Parse(time.RFC3339, t)
    if time.Since(ts).Abs() > 5*time.Minute { return false }
    h := hmac.New(sha256.New, []byte(secret))
    h.Write([]byte(t + "." + body))
    expected := hex.EncodeToString(h.Sum(nil))
    return hmac.Equal([]byte(v1), []byte(expected))
}