Verifying Webhook Signatures

import hashlib
import hmac
import os
import time

from fastapi import FastAPI, HTTPException, Request

app = FastAPI()

WEBHOOK_SECRET = os.environ["EACHLABS_WEBHOOK_SECRET"].encode()
TOLERANCE_SECONDS = 300


@app.post("/webhooks/eachlabs")
async def handle_webhook(request: Request):
    timestamp = request.headers.get("X-Webhook-Timestamp", "")
    signature = request.headers.get("X-Webhook-Signature", "")

    # Raw bytes, before any JSON parsing.
    body = await request.body()

    if not timestamp.isdigit():
        raise HTTPException(status_code=401, detail="missing or malformed timestamp")

    if abs(time.time() - int(timestamp)) > TOLERANCE_SECONDS:
        raise HTTPException(status_code=401, detail="timestamp outside tolerance")

    if not signature.startswith("sha256="):
        raise HTTPException(status_code=401, detail="malformed signature")

    signed = timestamp.encode() + b"." + body
    expected = hmac.new(WEBHOOK_SECRET, signed, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(expected, signature[len("sha256="):]):
        raise HTTPException(status_code=401, detail="signature mismatch")

    payload = await request.json()
    print(f"Verified delivery for {payload.get('execution_id') or payload.get('exec_id')}")

    return {"received": True}

const crypto = require("crypto");
const express = require("express");

const app = express();

const WEBHOOK_SECRET = process.env.EACHLABS_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

// express.raw() must come before any express.json() for this route,
// otherwise the raw body is gone by the time you verify.
app.post(
  "/webhooks/eachlabs",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const timestamp = req.get("X-Webhook-Timestamp") || "";
    const signature = req.get("X-Webhook-Signature") || "";

    if (!/^\d+$/.test(timestamp)) {
      return res.status(401).json({ error: "missing or malformed timestamp" });
    }

    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE_SECONDS) {
      return res.status(401).json({ error: "timestamp outside tolerance" });
    }

    const expected =
      "sha256=" +
      crypto
        .createHmac("sha256", WEBHOOK_SECRET)
        .update(timestamp + ".")
        .update(req.body) // Buffer holding the raw body
        .digest("hex");

    const a = Buffer.from(expected);
    const b = Buffer.from(signature);

    // timingSafeEqual throws when the lengths differ, so check length first.
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).json({ error: "signature mismatch" });
    }

    const payload = JSON.parse(req.body.toString("utf8"));
    console.log(`Verified delivery for ${payload.execution_id || payload.exec_id}`);

    res.json({ received: true });
  },
);