Webhook Signature Verification

X-CipherStream-Signature: sha256=<hmac_signature>
X-CipherStream-Timestamp: 1706745600
X-CipherStream-Delivery-ID: dlv_abc123 

 
import hmac
import hashlib

def verify_signature(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", signature)

# Usage
raw_body = request.body  # Raw bytes, not parsed JSON
signature = request.headers.get('X-CipherStream-Signature')
if not verify_signature(raw_body, signature, your_webhook_secret):
    return Response(status=401)

 
const crypto = require('crypto');

function verifySignature(payload, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

// Usage
const rawBody = req.rawBody; // Raw string, not parsed
const signature = req.headers['x-cipherstream-signature'];
if (!verifySignature(rawBody, signature, yourWebhookSecret)) {
  return res.status(401).send('Invalid signature');
}

using System.Security.Cryptography;
using System.Text;

public static bool VerifySignature(string payload, string signature, string secret)
{
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
    var expected = "sha256=" + BitConverter.ToString(hash).Replace("-", "").ToLower();
    return CryptographicOperations.FixedTimeEquals(
        Encoding.UTF8.GetBytes(expected),
        Encoding.UTF8.GetBytes(signature)
    );
} 

 
def verify_with_rotation(payload: bytes, signature: str, 
                         current_secret: str, previous_secret: str = None) -> bool:
    # Try current secret first
    if verify_signature(payload, signature, current_secret):
        return True
    # Fall back to previous secret during rotation
    if previous_secret and verify_signature(payload, signature, previous_secret):
        return True
    return False