Webhooks

const crypto = require("crypto")

const key = webhook_secret
const message = webhook_body // raw webhook request body, don't use parse, to_string, stringify, dump, etc.
const received_signature = webhook_signature

const expected_signature = crypto.createHmac('sha256', key).update(message).digest('hex') // create hmac of the webhook body using sha 256

if !crypto.timingSafeEqual(expected_signature, received_signature) // secure hmac comparison method
    throw Error // signature mismatch due to unauthentic webhook call

if sys.version_info[0] == 3:  # pragma: no cover
    key = bytes(webhook_secret, 'utf-8')
    message = bytes(webhook_body, 'utf-8') # raw webhook request body, don't use parse, to_string, stringify, dump, etc.
else:
    key = webhook_secret
    message = webhook_body # raw webhook request body, don't use parse, to_string, stringify, dump, etc.

received_signature = webhook_signature

dig = hmac.new(key=key, msg=message, digestmod=hashlib.sha256) # create hmac of the webhook body using sha 256
expected_signature = dig.hexdigest()

if sys.version_info[0:3] < (2, 7, 7):
    if len(expected_signature) != len(received_signature): # signature length mismatch, no point comparing further
        result = False
        break

    r = 0
    for x, y in zip(expected_signature, received_signature): # byte match using XOR
        r |= ord(x) ^ ord(y)
    result = r == 0
else:
    result = hmac.compare_digest(expected_signature, received_signature) # secure hmac comparison method, only available in python versions 2.7.7 and above

if not result:
    raise Exception() # signature mismatch due to unauthentic webhook call

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

import org.apache.commons.codec.binary.Hex;
import org.json.JSONObject;

public static void verifySignature(String webhookBody, String webhookSignature, String webhookSecret) throws Exception {
    String key = webhookSecret;
    String message = webhookBody; // raw webhook request body, don't use parse, to_string, stringify, dump, etc.
    String receivedSignature = webhookSignature;

    String expectedSignature;
    Mac sha256_HMAC;
    try { // create hmac of the webhook body using sha 256
        sha256_HMAC = Mac.getInstance("HmacSHA256");
        SecretKeySpec secret_key = new SecretKeySpec(key.getBytes("UTF-8"), "HmacSHA256");
        sha256_HMAC.init(secret_key);
        byte[] hash = sha256_HMAC.doFinal(message.getBytes());
        expectedSignature = new String(Hex.encodeHex(hash));
    } catch (Exception e) {
        throw new Exception(e.getMessage());
    }

    byte[] a = expectedSignature.getBytes();
    byte[] b = receivedSignature.getBytes();
    int result = 0;

    if (a.length != b.length) { // signature length mismatch, no point comparing further
        result = 1;
    } else {
        for (int i = 0; i < a.length; i++) { // byte match using XOR
            result |= a[i] ^ b[i];
        }
    }

    if (result != 0) {
        throw new Exception(); // signature mismatch due to unauthentic webhook call
    }
}

require 'openssl'

key = webhook_secret
message = webhook_body # raw webhook request body, don't use parse, to_string, stringify, dump, etc.
received_signature = webhook_signature

expected_signature = OpenSSL::HMAC.hexdigest('SHA256', key, message) # create hmac of the webhook body using sha 256

unless expected_signature.bytesize == received_signature.bytesize # signature length mismatch, no point comparing further
    result = false
else
    l = expected_signature.unpack('C*')
    r = 0
    i = -1
    received_signature.each_byte do |v| # byte match using XOR
        i+=1
        r |= v ^ l[i]
    end
    result = r.zero?
end

raise Error unless result # signature mismatch due to unauthentic webhook call

const SHA256 = 'sha256';

$key = $webhookSecret;
$message = $webhookBody; // raw webhook request body, don't use parse, to_string, stringify, dump, etc.
$receivedSignature = $webhookSignature;

$expectedSignature = hash_hmac(self::SHA256, $message, $key); // create hmac of the webhook body using sha 256

if (function_exists('hash_equals'))
{
    $verified = hash_equals($expectedSignature, $receivedSignature); // secure hmac comparison method
}
else
{
    if (strlen($expectedSignature) === strlen($receivedSignature)) // signature length mismatch, no point comparing further
    {
        $res = $expectedSignature ^ $receivedSignature;
        $return = 0;

        for ($i = strlen($res) - 1; $i >= 0; $i--) // byte match using XOR
        {
            $return |= ord($res[$i]);
        }

        $verified = ($return === 0);
    }
    else
    {
        $verified = false;
    }
}

if ($verified === false)
{
    throw new Error(); // signature mismatch due to unauthentic webhook call
}

using System;
using System.Text;
using System.Collections.Generic;
using System.Security.Cryptography;

private static void verifySignature(string webhookBody, string webhookSignature, string webhookSecret)
{
    string key = webhookSecret;
    string message = webhookBody; // raw webhook request body, don't use parse, to_string, stringify, dump, etc.
    string receivedSignature = webhookSignature;

    byte[] keyBytes = Encoding.ASCII.GetBytes(key); // create hmac of the webhook body using sha 256
    HMACSHA256 hashHmac = new HMACSHA256(keyBytes);
    byte[] bytes = Encoding.ASCII.GetBytes(message);
    byte[] expectedSignatureBytes = hashHmac.ComputeHash(bytes);
    byte[] receivedSignatureBytes = Encoding.ASCII.GetBytes(receivedSignature);

    bool verified;
    if (expectedSignatureBytes.Length != receivedSignatureBytes.Length) // signature length mismatch, no point comparing further
    {
        verified = false;
    }
    else
    {
        for (int i = 0; i < expectedSignatureBytes.Length; ++i) // byte match using XOR
        {
            x |= expectedSignatureBytes[i] ^ receivedSignatureBytes[i];
        }
        verified = x == 0;
    }

    if (verified == false)
    {
        throw new Error(); // signature mismatch due to unauthentic webhook call
    }
}