Verifying Webhook Signatures

import crypto from "crypto";

export function verifyWireboxSignature(
  rawBody: string,
  signatureHeader: string,
  secret: string,
  toleranceSeconds: number = 300
): boolean {
  // 1. Parse header components
  const elements = signatureHeader.split(",");
  let timestamp: string | null = null;
  const signatures: string[] = [];

  for (const element of elements) {
    const [key, value] = element.trim().split("=");
    if (key === "t") timestamp = value;
    if (key === "v1") signatures.push(value);
  }

  if (!timestamp || signatures.length === 0) return false;

  // 2. Prevent replay attacks (5-minute tolerance)
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - parseInt(timestamp, 10)) > toleranceSeconds) {
    return false;
  }

  // 3. Compute expected signature
  const payloadToSign = `t=${timestamp}.${rawBody}`;
  const expectedSignature = crypto
    .createHmac("sha256", secret)
    .update(payloadToSign, "utf8")
    .digest("hex");

  // 4. Constant-time comparison
  for (const sig of signatures) {
    if (
      crypto.timingSafeEqual(
        Buffer.from(sig, "hex"),
        Buffer.from(expectedSignature, "hex")
      )
    ) {
      return true;
    }
  }

  return false;
}

import hmac
import hashlib
import time

def verify_wirebox_signature(raw_body: str, signature_header: str, secret: str, tolerance: int = 300) -> bool:
    pairs = dict(item.strip().split("=") for item in signature_header.split(","))
    timestamp = pairs.get("t")
    v1_signature = pairs.get("v1")

    if not timestamp or not v1_signature:
        return False

    # Check timestamp freshness
    if abs(time.time() - int(timestamp)) > tolerance:
        return False

    # Calculate HMAC
    string_to_sign = f"t={timestamp}.{rawBody}".encode("utf-8")
    expected = hmac.new(secret.encode("utf-8"), string_to_sign, hashlib.sha256).hexdigest()

    return hmac.compare_digest(v1_signature, expected)