Overview

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret, timestamp) {
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - timestamp) > 300) {
    throw new Error('Webhook timestamp too old');
  }

  const secretBytes = Buffer.from(secret, 'base64');
  const expectedSignature = crypto
    .createHmac('sha256', secretBytes)
    .update(payload, 'utf8')
    .digest('hex');

  if (signature.startsWith('sha256=')) {
    signature = signature.substring(7);
  }

  if (!crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  )) {
    throw new Error('Webhook signature verification failed');
  }
  return true;
}

import hmac, hashlib, time, base64

def verify_webhook_signature(payload, signature, secret, timestamp):
    current_time = int(time.time())
    if abs(current_time - timestamp) > 300:
        raise ValueError('Webhook timestamp too old')

    secret_bytes = base64.b64decode(secret)
    expected_signature = hmac.new(
        secret_bytes, payload.encode(), hashlib.sha256
    ).hexdigest()

    if signature.startswith('sha256='):
        signature = signature[7:]

    if not hmac.compare_digest(signature, expected_signature):
        raise ValueError('Webhook signature verification failed')
    return True

<?php
function verifyWebhookSignature($payload, $signature, $secret, $timestamp) {
    $currentTime = time();
    if (abs($currentTime - $timestamp) > 300) {
        throw new Exception('Webhook timestamp too old');
    }

    $secretBytes = base64_decode($secret);
    $expectedSignature = hash_hmac('sha256', $payload, $secretBytes);

    if (strpos($signature, 'sha256=') === 0) {
        $signature = substr($signature, 7);
    }

    if (!hash_equals($expectedSignature, $signature)) {
        throw new Exception('Webhook signature verification failed');
    }
    return true;
}
?>

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import java.util.Base64;

public class WebhookVerifier {

    public static boolean verifyWebhookSignature(
        byte[] payload,
        String signature,
        String secret,
        String timestamp
    ) throws Exception {
        long currentTime = System.currentTimeMillis() / 1000;
        if (Math.abs(currentTime - Long.parseLong(timestamp)) > 300) {
            throw new IllegalArgumentException("Webhook timestamp too old");
        }

        byte[] secretBytes = Base64.getDecoder().decode(secret);
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secretBytes, "HmacSHA256"));
        String expectedSignature = bytesToHex(mac.doFinal(payload));

        String incoming = signature.startsWith("sha256=") ? signature.substring(7) : signature;

        if (!MessageDigest.isEqual(
            incoming.getBytes(),
            expectedSignature.getBytes()
        )) {
            throw new SecurityException("Webhook signature verification failed");
        }
        return true;
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) sb.append(String.format("%02x", b));
        return sb.toString();
    }
}