Setting Up Webhooks

import hashlib
import hmac
import time

def verify_bachs_signature(
    raw_body: bytes,
    secret: str,
    timestamp_header: str,
    signature_header: str,
    tolerance_seconds: int = 300,
) -> bool:
    # Reject stale deliveries
    timestamp = int(timestamp_header)
    if abs(time.time() - timestamp) > tolerance_seconds:
        return False

    message = f"{timestamp}.{raw_body.decode('utf-8')}"
    expected = hmac.new(
        secret.encode(), message.encode("utf-8"), hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(expected, signature_header)

const crypto = require("crypto");

function verifyBachsSignature(
  rawBody,
  secret,
  timestampHeader,
  signatureHeader,
  toleranceSeconds = 300
) {
  const timestamp = parseInt(timestampHeader, 10);

  // Reject stale deliveries
  if (Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) {
    return false;
  }

  const message = `${timestamp}.${rawBody}`;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(message, "utf8")
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;

public class BachsWebhookVerifier {

    public static boolean verify(
        String rawBody,
        String secret,
        String timestampHeader,
        String signatureHeader,
        int toleranceSeconds
    ) throws Exception {
        long timestamp = Long.parseLong(timestampHeader);

        // Reject stale deliveries
        if (Math.abs(Instant.now().getEpochSecond() - timestamp) > toleranceSeconds) {
            return false;
        }

        String message = timestamp + "." + rawBody;

        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] hashBytes = mac.doFinal(message.getBytes(StandardCharsets.UTF_8));

        StringBuilder hex = new StringBuilder();
        for (byte b : hashBytes) {
            hex.append(String.format("%02x", b));
        }
        String expected = hex.toString();

        return MessageDigest.isEqual(
            expected.getBytes(StandardCharsets.UTF_8),
            signatureHeader.getBytes(StandardCharsets.UTF_8)
        );
    }
}