Verification des signatures webhook

const crypto = require("crypto");

function verifyWebhookSignature(body, secret, signature) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(body)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

app.post("/webhook", (req, res) => {
  const signature = req.headers["x-webhook-signature"];
  const body = JSON.stringify(req.body);

  if (!verifyWebhookSignature(body, "votre_secret", signature)) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  // Traiter l'evenement...
  res.status(200).json({ received: true });
});

import hmac
import hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)

def verify_signature(body, secret, signature):
    expected = hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

@app.route("/webhook", methods=["POST"])
def webhook():
    signature = request.headers.get("X-Webhook-Signature", "")
    if not verify_signature(request.data, "votre_secret", signature):
        return jsonify({"error": "Invalid signature"}), 401

    return jsonify({"received": True}), 200

<?php
$body = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$secret = 'votre_secret';

$expected = hash_hmac('sha256', $body, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

http_response_code(200);
echo json_encode(['received' => true]);