Verifying signatures

require "openssl"

TOLERANCE = 300 # seconds

def valid_signature?(raw_body, header, secret)
  parts = header.to_s.split(",").map(&:strip)
  timestamp = parts.find { |p| p.start_with?("t=") }&.delete_prefix("t=")
  return false if timestamp.nil? || (Time.now.to_i - timestamp.to_i).abs > TOLERANCE

  expected = OpenSSL::HMAC.hexdigest("sha256", secret, "#{timestamp}.#{raw_body}")
  parts.select { |p| p.start_with?("v1=") }.any? do |candidate|
    ActiveSupport::SecurityUtils.secure_compare(candidate.delete_prefix("v1="), expected)
  end
end

const crypto = require("crypto");

const TOLERANCE = 300; // seconds

function validSignature(rawBody, header, secret) {
  const parts = (header || "").split(",").map((s) => s.trim());
  const timestamp = parts.find((p) => p.startsWith("t="))?.slice(2);
  if (!timestamp || Math.abs(Date.now() / 1000 - Number(timestamp)) > TOLERANCE) {
    return false;
  }

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  const expectedBuf = Buffer.from(expected);
  return parts
    .filter((p) => p.startsWith("v1="))
    .some((candidate) => {
      const candidateBuf = Buffer.from(candidate.slice(3));
      return (
        candidateBuf.length === expectedBuf.length &&
        crypto.timingSafeEqual(candidateBuf, expectedBuf)
      );
    });
}

import hmac, hashlib, time

TOLERANCE = 300  # seconds

def valid_signature(raw_body: bytes, header: str, secret: str) -> bool:
    parts = [p.strip() for p in (header or "").split(",")]
    timestamp = next((p[2:] for p in parts if p.startswith("t=")), None)
    if timestamp is None or abs(time.time() - int(timestamp)) > TOLERANCE:
        return False

    signed = f"{timestamp}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return any(
        hmac.compare_digest(p[3:], expected)
        for p in parts
        if p.startswith("v1=")
    )