Webhooks

import hashlib, hmac, time

def verify(secret: str, body: bytes, header: str, max_age: int = 300) -> bool:
    parts = dict(p.split('=', 1) for p in header.split(',') if '=' in p)
    ts = parts.get('t', '')
    if not ts.isdigit() or abs(time.time() - int(ts)) > max_age:
        return False
    expected = hmac.new(secret.encode(), f'{ts}.'.encode() + body,
                        hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, v.split('=', 1)[1])
               for v in header.split(',') if v.startswith('v1='))

import crypto from 'node:crypto'

export function verify(secret, body, header, maxAge = 300) {
  const parts = Object.fromEntries(
    header.split(',').map(p => p.split('=', 2)))
  const ts = Number(parts.t)
  if (!ts || Math.abs(Date.now() / 1000 - ts) > maxAge) return false
  const expected = crypto.createHmac('sha256', secret)
    .update(`${ts}.`).update(body).digest('hex')
  return header.split(',').filter(p => p.startsWith('v1='))
    .some(p => crypto.timingSafeEqual(
      Buffer.from(expected), Buffer.from(p.slice(3))))
}