Webhooks

func verify(r *http.Request, body []byte, secret string) bool {
    id := r.Header.Get("X-Slipway-Webhook-Id")
    ts := r.Header.Get("X-Slipway-Timestamp")
    sig := r.Header.Get("X-Slipway-Webhook-Signature")

    // Reject stale timestamps to block replays.
    sec, err := strconv.ParseInt(ts, 10, 64)
    if err != nil || time.Since(time.Unix(sec, 0)) > 5*time.Minute {
        return false
    }

    mac := hmac.New(sha256.New, []byte(secret))
    fmt.Fprintf(mac, "%s.%s.", id, ts)
    mac.Write(body)
    want := "v1=" + hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(sig), []byte(want))
}

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(req, rawBody, secret) {
  const id = req.headers["x-slipway-webhook-id"];
  const ts = req.headers["x-slipway-timestamp"];
  const sig = req.headers["x-slipway-webhook-signature"];

  // Reject stale timestamps to block replays.
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const digest = createHmac("sha256", secret)
    .update(`${id}.${ts}.`)
    .update(rawBody)
    .digest("hex");
  const want = Buffer.from(`v1=${digest}`);
  const got = Buffer.from(String(sig));
  return want.length === got.length && timingSafeEqual(want, got);
}