Verifying webhooks

const crypto = require("crypto");

// express.raw keeps the body as the exact bytes we sent.
app.post("/webhooks/platnova", express.raw({ type: "application/json" }), (req, res) => {
  const expected = "sha256=" +
    crypto.createHmac("sha256", process.env.PLATNOVA_WEBHOOK_SECRET).update(req.body).digest("hex");
  const given = req.get("X-Platnova-Signature") || "";

  const a = Buffer.from(expected);
  const b = Buffer.from(given);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send("invalid signature");
  }

  const event = JSON.parse(req.body.toString("utf8"));
  // ... queue the event for processing, then answer quickly
  res.status(200).json({ received: true });
});

import hashlib, hmac, os
from flask import request, abort

@app.post("/webhooks/platnova")
def platnova_webhook():
    raw = request.get_data()  # the raw bytes, before parsing
    expected = "sha256=" + hmac.new(
        os.environ["PLATNOVA_WEBHOOK_SECRET"].encode("utf-8"), raw, hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-Platnova-Signature", "")):
        abort(401)
    event = request.get_json()
    # ... queue the event for processing, then answer quickly
    return {"received": True}, 200

func platnovaWebhook(w http.ResponseWriter, r *http.Request) {
	raw, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "bad request", http.StatusBadRequest)
		return
	}
	mac := hmac.New(sha256.New, []byte(os.Getenv("PLATNOVA_WEBHOOK_SECRET")))
	mac.Write(raw)
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	if !hmac.Equal([]byte(expected), []byte(r.Header.Get("X-Platnova-Signature"))) {
		http.Error(w, "invalid signature", http.StatusUnauthorized)
		return
	}
	// ... json.Unmarshal(raw, &event), queue it, then answer quickly
	w.WriteHeader(http.StatusOK)
}

$raw = file_get_contents('php://input'); // the raw bytes, before json_decode
$expected = 'sha256=' . hash_hmac('sha256', $raw, getenv('PLATNOVA_WEBHOOK_SECRET'));
$given = $_SERVER['HTTP_X_PLATNOVA_SIGNATURE'] ?? '';

if (!hash_equals($expected, $given)) {
    http_response_code(401);
    exit('invalid signature');
}
$event = json_decode($raw, true);
// ... queue the event for processing, then answer quickly
http_response_code(200);