Verifying webhooks

import express from "express";
import crypto from "crypto";

const app = express();

// Capture the raw body so the signature is computed over the exact bytes.
app.use("/webhooks/formable", express.raw({ type: "application/json" }));

app.post("/webhooks/formable", (req, res) => {
  const received = req.header("Content-Sha256");
  const secret = Buffer.from(process.env.FORMABLE_WEBHOOK_SECRET, "base64");

  const expected = crypto
    .createHmac("sha256", secret)
    .update(req.body) // req.body is a Buffer of the raw bytes
    .digest("base64");

  const valid =
    received &&
    expected.length === received.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));

  if (!valid) {
    return res.status(401).send("Invalid signature");
  }

  const event = JSON.parse(req.body.toString("utf8"));
  // handle event...
  res.sendStatus(200);
});

import base64
import hashlib
import hmac
import os

from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/formable")
def formable_webhook():
    received = request.headers.get("Content-Sha256", "")
    secret = base64.b64decode(os.environ["FORMABLE_WEBHOOK_SECRET"])

    # request.get_data() returns the exact raw bytes of the body.
    digest = hmac.new(secret, request.get_data(), hashlib.sha256).digest()
    expected = base64.b64encode(digest).decode()

    if not hmac.compare_digest(expected, received):
        abort(401)

    event = request.get_json()
    # handle event...
    return "", 200

$rawBody = file_get_contents('php://input');
$headers = getallheaders();
$received = $headers['Content-Sha256'] ?? '';
$secret = base64_decode(getenv('FORMABLE_WEBHOOK_SECRET'), true);

$expected = base64_encode(hash_hmac('sha256', $rawBody, $secret, true));

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
// handle event...
http_response_code(200);