Validate Generic webhook signatures

import { createHmac, timingSafeEqual } from "node:crypto";

const MAX_AGE_SECONDS = 5 * 60;
const SIGNATURE_PATTERN = /^v1=([0-9a-f]{64})$/;

export function verifyPointWarden(
  rawBody,
  timestamp,
  signature,
  secret,
) {
  const match = SIGNATURE_PATTERN.exec(signature ?? "");
  const timestampSeconds = /^\d+$/.test(timestamp ?? "")
    ? Number(timestamp)
    : Number.NaN;
  const now = Math.floor(Date.now() / 1000);

  if (
    !timestamp ||
    !match ||
    !Number.isSafeInteger(timestampSeconds) ||
    timestampSeconds < now - MAX_AGE_SECONDS ||
    timestampSeconds > now + MAX_AGE_SECONDS
  ) {
    return false;
  }

  const expected = createHmac("sha256", secret)
    .update(timestamp, "utf8")
    .update(".", "utf8")
    .update(rawBody)
    .digest();
  const received = Buffer.from(match[1], "hex");

  if (received.length !== expected.length) {
    return false;
  }
  return timingSafeEqual(received, expected);
}

import hashlib
import hmac
import re
import time

MAX_AGE_SECONDS = 5 * 60
SIGNATURE_PATTERN = re.compile(r"^v1=([0-9a-f]{64})$")
TIMESTAMP_PATTERN = re.compile(r"^[0-9]+$")


def verify_pointwarden(
    raw_body: bytes,
    timestamp: str | None,
    signature: str | None,
    secret: str,
) -> bool:
    match = SIGNATURE_PATTERN.fullmatch(signature or "")
    if not timestamp or not TIMESTAMP_PATTERN.fullmatch(timestamp) or not match:
        return False

    timestamp_seconds = int(timestamp)
    now = int(time.time())
    if not now - MAX_AGE_SECONDS <= timestamp_seconds <= now + MAX_AGE_SECONDS:
        return False

    message = timestamp.encode("utf-8") + b"." + raw_body
    expected = hmac.new(
        secret.encode("utf-8"),
        message,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(match.group(1), expected)

package webhook

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"regexp"
	"strconv"
	"time"
)

const maxAgeSeconds int64 = 5 * 60

var signaturePattern = regexp.MustCompile("^v1=([0-9a-f]{64})$")
var timestampPattern = regexp.MustCompile("^[0-9]+$")

func VerifyPointWarden(
	rawBody []byte,
	timestamp string,
	signature string,
	secret string,
) bool {
	match := signaturePattern.FindStringSubmatch(signature)
	timestampSeconds, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil || !timestampPattern.MatchString(timestamp) || len(match) != 2 {
		return false
	}

	now := time.Now().Unix()
	if timestampSeconds < now-maxAgeSeconds ||
		timestampSeconds > now+maxAgeSeconds {
		return false
	}

	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(timestamp))
	mac.Write([]byte{'.'})
	mac.Write(rawBody)

	received, err := hex.DecodeString(match[1])
	if err != nil {
		return false
	}
	return hmac.Equal(received, mac.Sum(nil))
}

using System.Globalization;
using System.Security.Cryptography;
using System.Text;
using System.Text.RegularExpressions;

public static class PointWardenWebhook
{
    private const long MaxAgeSeconds = 5 * 60;

    public static bool Verify(
        byte[] rawBody,
        string? timestamp,
        string? signature,
        string secret)
    {
        if (
            timestamp is null ||
            signature is null ||
            !Regex.IsMatch(timestamp, @"^[0-9]+$") ||
            !Regex.IsMatch(signature, @"^v1=[0-9a-f]{64}$") ||
            !long.TryParse(
                timestamp,
                NumberStyles.None,
                CultureInfo.InvariantCulture,
                out var timestampSeconds))
        {
            return false;
        }

        var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
        if (
            timestampSeconds < now - MaxAgeSeconds ||
            timestampSeconds > now + MaxAgeSeconds)
        {
            return false;
        }

        var prefix = Encoding.UTF8.GetBytes(timestamp + ".");
        var message = new byte[prefix.Length + rawBody.Length];
        Buffer.BlockCopy(prefix, 0, message, 0, prefix.Length);
        Buffer.BlockCopy(rawBody, 0, message, prefix.Length, rawBody.Length);

        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
        var expected = hmac.ComputeHash(message);
        var received = Convert.FromHexString(signature[3..]);
        return CryptographicOperations.FixedTimeEquals(received, expected);
    }
}

import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.HexFormat;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

final class PointWardenWebhook {
  private static final long MAX_AGE_SECONDS = 5 * 60;
  private static final Pattern SIGNATURE_PATTERN =
      Pattern.compile("^v1=([0-9a-f]{64})$");

  static boolean verify(
      byte[] rawBody,
      String timestamp,
      String signature,
      String secret
  ) throws GeneralSecurityException {
    if (
        timestamp == null ||
        signature == null ||
        !timestamp.matches("[0-9]+")
    ) {
      return false;
    }

    Matcher match = SIGNATURE_PATTERN.matcher(signature);
    if (!match.matches()) {
      return false;
    }

    final long timestampSeconds;
    try {
      timestampSeconds = Long.parseLong(timestamp);
    } catch (NumberFormatException error) {
      return false;
    }

    long now = Instant.now().getEpochSecond();
    if (
        timestampSeconds < now - MAX_AGE_SECONDS ||
        timestampSeconds > now + MAX_AGE_SECONDS
    ) {
      return false;
    }

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(
        secret.getBytes(StandardCharsets.UTF_8),
        "HmacSHA256"
    ));
    mac.update(timestamp.getBytes(StandardCharsets.UTF_8));
    mac.update((byte) '.');
    byte[] expected = mac.doFinal(rawBody);
    byte[] received = HexFormat.of().parseHex(match.group(1));
    return MessageDigest.isEqual(received, expected);
  }
}