Webhook signatures

import crypto from 'crypto';

function verifyPajWebhook(rawBody, headers, secret) {
  const timestamp = headers['x-paj-timestamp'];
  const received = (headers['x-paj-signature'] ?? '').replace('v1=', '');

  // Reject stale deliveries before doing any crypto.
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return false;
  }

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  // Both are hex of the same length, so this cannot throw on length mismatch.
  if (received.length !== expected.length) return false;

  return crypto.timingSafeEqual(
    Buffer.from(received),
    Buffer.from(expected),
  );
}

import hashlib, hmac, time

def verify_paj_webhook(raw_body: bytes, headers, secret: str) -> bool:
    timestamp = headers.get("X-PAJ-Timestamp", "")
    received = headers.get("X-PAJ-Signature", "").removeprefix("v1=")

    if abs(time.time() - int(timestamp)) > 300:
        return False

    expected = hmac.new(
        secret.encode(),
        f"{timestamp}.".encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(received, expected)