Webhook security

import crypto from "node:crypto";

app.post("/webhooks/robase", express.raw({ type: "*/*" }), (req, res) => {
  const sig = req.headers["x-robase-signature"];
  const expected = crypto
    .createHmac("sha256", process.env.ROBASE_WEBHOOK_SECRET)
    .update(req.body)
    .digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.status(401).end();
  }

  const event = JSON.parse(req.body.toString());
  // event.event is "otp.sent", "sms.delivered", ...
  res.json({ received: true });
});

body, _ := io.ReadAll(r.Body)
sig := r.Header.Get("X-Robase-Signature")

mac := hmac.New(sha256.New, []byte(os.Getenv("ROBASE_WEBHOOK_SECRET")))
mac.Write(body)
expected := hex.EncodeToString(mac.Sum(nil))

if !hmac.Equal([]byte(sig), []byte(expected)) {
    http.Error(w, "invalid signature", http.StatusUnauthorized)
    return
}

$body = file_get_contents('php://input');
$sig = $_SERVER['HTTP_X_ROBASE_SIGNATURE'] ?? '';
$expected = hash_hmac('sha256', $body, getenv('ROBASE_WEBHOOK_SECRET'));

if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit;
}