Webhook Signature Verification

const crypto = require("crypto");

function verify(req) {
  const ts = req.headers["x-webhook-timestamp"];
  const rawBody = req.rawBody; // middleware must store raw body
  const secretKey = "<client-secret>";
  const signStr = ts + rawBody;
  return crypto.createHmac("sha256", secretKey).update(signStr).digest("base64");
}

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "io/ioutil"
)

func VerifySignature(expectedSig, ts, body string) (string, error) {
    signStr := ts + body
    key := "<client-secret>"
    h := hmac.New(sha256.New, []byte(key))
    h.Write([]byte(signStr))
    b := h.Sum(nil)
    return base64.StdEncoding.EncodeToString(b), nil
}

// usage
timestamp := c.Request().Header.Get("x-webhook-timestamp")
body, _ := ioutil.ReadAll(c.Request().Body)
rawBody := string(body)
signature := c.Request().Header.Get("x-webhook-signature")

VerifySignature(signature, timestamp, rawBody)

function computeSignature() {
    $rawBody = file_get_contents('php://input');
    $ts = getallheaders()['x-webhook-timestamp'];

    $signStr = $ts . $rawBody;
    $key = "<client-secret>";
    $computeSig = base64_encode(hash_hmac('sha256', $signStr, $key, true));
    return $computeSig; // compare with x-webhook-signature
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

public String generateSignature(HttpServletRequest request) throws Exception {
    BufferedReader bufferedReader = request.getReader();
    StringBuilder stringBuilder = new StringBuilder();
    String line;
    while ((line = bufferedReader.readLine()) != null) {
        stringBuilder.append(line);
    }
    String payload = stringBuilder.toString();
    String timestamp = request.getHeader("x-webhook-timestamp");

    String data = timestamp + payload;
    String secretKey = "<client-secret>";

    Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
    SecretKeySpec secret_key_spec = new SecretKeySpec(secretKey.getBytes(), "HmacSHA256");
    sha256_HMAC.init(secret_key_spec);

    return Base64.getEncoder().encodeToString(sha256_HMAC.doFinal(data.getBytes()));
}

import base64
import hashlib
import hmac

def generateSignature(request):
    raw_body = request.data
    payload = raw_body.decode('utf-8')
    timestamp = request.headers['x-webhook-timestamp']

    signatureData = timestamp + payload
    message = bytes(signatureData, 'utf-8')
    secretkey = bytes("<client-secret>", 'utf-8')
    signature = base64.b64encode(hmac.new(secretkey, message, digestmod=hashlib.sha256).digest())
    return signature.decode("utf-8")  # compare with x-webhook-signature