Verifying webhooks

import crypto from 'node:crypto';

function verify(rawBody, header, secret) {
  const expected =
    'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');

  const a = Buffer.from(expected);
  const b = Buffer.from(header ?? '');

  // Length-check first: timingSafeEqual throws on a length mismatch.
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express — note the raw body parser, not express.json()
app.post(
  '/webhooks/lazyapp',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    if (!verify(req.body, req.get('X-LazyApp-Signature'), process.env.LAZYAPP_WEBHOOK_SECRET)) {
      return res.sendStatus(401);
    }

    const event = JSON.parse(req.body.toString('utf8'));
    void enqueue(event);

    res.sendStatus(200);
  },
);

import hashlib, hmac

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), raw_body, hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(expected, header or "")

$expected = 'sha256='.hash_hmac('sha256', $request->getContent(), $secret);

abort_unless(
    hash_equals($expected, (string) $request->header('X-LazyApp-Signature')),
    401,
);