Webhooks

using System.Security.Cryptography;
using System.Text;

public bool VerifyWebhook(string rawBody, string sigHeader, string webhookSecret)
{
    // Parse header: "t=1713614550,v1=abc123..."
    var parts = sigHeader.Split(',')
        .Select(s => s.Split('=', 2))
        .ToDictionary(kv => kv[0], kv => kv[1]);

    var timestamp = parts["t"];
    var providedSig = parts["v1"];

    // Reject stale webhooks (>5 minutes)
    var ts = DateTimeOffset.FromUnixTimeSeconds(long.Parse(timestamp));
    if (DateTimeOffset.UtcNow - ts > TimeSpan.FromMinutes(5)) return false;

    // Recompute and compare
    var message = $"{timestamp}.{rawBody}";
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(webhookSecret));
    var expected = Convert.ToHexString(hmac.ComputeHash(Encoding.UTF8.GetBytes(message))).ToLowerInvariant();

    return CryptographicOperations.FixedTimeEquals(
        Encoding.UTF8.GetBytes(providedSig),
        Encoding.UTF8.GetBytes(expected));
}

const crypto = require('crypto');

function verifyWebhook(rawBody, sigHeader, webhookSecret) {
  const parts = Object.fromEntries(sigHeader.split(',').map(s => s.split('=', 2)));
  const { t: timestamp, v1: providedSig } = parts;

  // Reject stale webhooks (>5 minutes)
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  return crypto.timingSafeEqual(Buffer.from(providedSig), Buffer.from(expected));
}