Webhooks: eventos de leads en tiempo real | DeltaLead

const crypto = require('crypto');

const TOLERANCE_SECONDS = 300;

function verifyWebhook(rawBody, signatureHeader, timestampHeader, secret) {
  const timestamp = Number(timestampHeader);
  if (!Number.isInteger(timestamp)) {
    return false;
  }
  const age = Math.abs(Math.floor(Date.now() / 1000) - timestamp);
  if (age > TOLERANCE_SECONDS) {
    return false;
  }
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestampHeader}.`)
    .update(rawBody)
    .digest('hex');
  if (expected.length !== signatureHeader.length) {
    return false;
  }
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300

def verify_webhook(
    raw_body: bytes,
    signature_header: str,
    timestamp_header: str,
    secret: str,
) -> bool:
    try:
        timestamp = int(timestamp_header)
    except ValueError:
        return False
    if abs(time.time() - timestamp) > TOLERANCE_SECONDS:
        return False
    signed_payload = timestamp_header.encode('utf-8') + b'.' + raw_body
    expected = hmac.new(
        secret.encode('utf-8'),
        signed_payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)

const TOLERANCE_SECONDS = 300;

function verifyWebhook(
    string $rawBody,
    string $signatureHeader,
    string $timestampHeader,
    string $secret
): bool {
    if (!ctype_digit($timestampHeader)) {
        return false;
    }
    if (abs(time() - (int) $timestampHeader) > TOLERANCE_SECONDS) {
        return false;
    }
    $expected = hash_hmac('sha256', $timestampHeader . '.' . $rawBody, $secret);
    return hash_equals($expected, $signatureHeader);
}