Verify InfraAudit Webhook Signatures

import (
  "crypto/hmac"
  "crypto/sha256"
  "encoding/hex"
  "net/http"
)

func verifySignature(r *http.Request, body []byte, secret string) bool {
  signature := r.Header.Get("X-InfraAudit-Signature")
  if signature == "" {
    return false
  }
  mac := hmac.New(sha256.New, []byte(secret))
  mac.Write(body)
  expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
  return hmac.Equal([]byte(signature), []byte(expected))
}

const crypto = require('crypto')

function verifySignature(body, secret, signature) {
  if (!signature) return false
  const hmac = crypto.createHmac('sha256', secret)
  hmac.update(body, 'utf8')
  const expected = 'sha256=' + hmac.digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(expected, 'utf8'),
    Buffer.from(signature, 'utf8')
  )
}

// Express example
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-infraaudit-signature']
  if (!verifySignature(req.body, process.env.WEBHOOK_SECRET, sig)) {
    return res.status(401).send('Invalid signature')
  }
  const payload = JSON.parse(req.body)
  // process payload...
  res.sendStatus(200)
})

import hashlib
import hmac

def verify_signature(body: bytes, secret: str, signature: str) -> bool:
    if not signature:
        return False
    mac = hmac.new(secret.encode(), body, hashlib.sha256)
    expected = 'sha256=' + mac.hexdigest()
    return hmac.compare_digest(expected, signature)

# Flask example
@app.route('/webhook', methods=['POST'])
def webhook():
    body = request.get_data()
    signature = request.headers.get('X-InfraAudit-Signature', '')
    if not verify_signature(body, WEBHOOK_SECRET, signature):
        abort(401)
    payload = request.get_json(force=True)
    # process payload...
    return '', 200