Webhook Signature

const crypto = require('crypto');

// rawBody must be the unparsed request body (e.g. express.raw({ type: 'application/json' }))
function isValidWebhook(rawBody, headers, secret) {
  const timestamp = headers['x-webhook-wp-timestamp'];
  const signature = headers['x-webhook-wp-signature'];
  if (!timestamp || !signature) return false;

  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody + timestamp)
    .digest('hex');

  return expected.length === signature.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

import hashlib
import hmac
import time

def is_valid_webhook(raw_body: bytes, headers: dict, secret: str) -> bool:
    timestamp = headers.get("x-webhook-wp-timestamp")
    signature = headers.get("x-webhook-wp-signature")
    if not timestamp or not signature:
        return False

    if abs(time.time() - int(timestamp)) > 300:
        return False

    expected = hmac.new(
        secret.encode(), raw_body + timestamp.encode(), hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(expected, signature)

function isValidWebhook(string $rawBody, array $headers, string $secret): bool
{
    $timestamp = $headers['x-webhook-wp-timestamp'] ?? null;
    $signature = $headers['x-webhook-wp-signature'] ?? null;
    if (! $timestamp || ! $signature) {
        return false;
    }

    if (abs(time() - (int) $timestamp) > 300) {
        return false;
    }

    $expected = hash_hmac('sha256', $rawBody . $timestamp, $secret);

    return hash_equals($expected, $signature);
}

// $rawBody = file_get_contents('php://input');