assinando requisições

const crypto = require('crypto');
function validateSignature(body, timestamp, signature, secret) {
  // cria a string assinada: timestamp.body
  const payload = timestamp + '.' + JSON.stringify(body);
  // calcula HMAC-SHA256
  const hash = crypto
  .createHmac('sha256', secret)
  .update(payload)
  .digest('hex');
  // compara com o header recebido
  const expected = 'sha256=' + hash;
  return signature === expected;
}
app.post('/webhooks', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const timestamp = req.headers['x-webhook-timestamp'];
  // valida a assinatura
  if (!validateSignature(req.body, timestamp, signature, 'seu-secret')) {
  return res.status(401).json({ error: 'invalid signature' });
  }
  // processa webhook
  res.status(200).json({ ok: true });
});

import hmac
import hashlib
import json

def validate_signature(body, timestamp, signature, secret):
  # cria a string assinada: timestamp.body
  if isinstance(body, dict):
    body_str = json.dumps(body, separators=(',', ':'))
  else:
    body_str = body

  payload = f"{timestamp}.{body_str}"

  # calcula HMAC-SHA256
  expected_hash = hmac.new(
    secret.encode(),
    payload.encode(),
    hashlib.sha256
  ).hexdigest()

  expected_sig = 'sha256=' + expected_hash
  return signature == expected_sig

@app.post('/webhooks')
async def webhook(request: Request):
  body = await request.json()
  signature = request.headers.get('x-webhook-signature')
  timestamp = request.headers.get('x-webhook-timestamp')

  # valida a assinatura
  if not validate_signature(body, timestamp, signature, 'seu-secret'):
    return {"error": "invalid signature"}, 401

  # processa webhook
  return {"ok": True}

import (
  "crypto/hmac"
  "crypto/sha256"
  "encoding/hex"
  "encoding/json"
  "fmt"
)

func validateSignature(body []byte, timestamp, signature, secret string) bool {
  // cria a string assinada: timestamp.body
  payload := fmt.Sprintf("%s.%s", timestamp, string(body))

  // calcula HMAC-SHA256
  h := hmac.New(sha256.New, []byte(secret))
  h.Write([]byte(payload))
  hash := "sha256=" + hex.EncodeToString(h.Sum(nil))

  return hash == signature
}

router.POST("/webhooks", func(c *gin.Context) {
  body, _ := c.GetRawData()
  signature := c.GetHeader("X-Webhook-Signature")
  timestamp := c.GetHeader("X-Webhook-Timestamp")

  // valida a assinatura
  if !validateSignature(body, timestamp, signature, "seu-secret") {
    c.JSON(401, gin.H{"error": "invalid signature"})
    return
  }

  // processa webhook
  c.JSON(200, gin.H{"ok": true})
})