Verificação e segurança

import crypto from "node:crypto"

export function validarAssinatura(header: string, secret: string, rawBody: string): boolean {
  const [tsPart, v1Part] = header.split(",")
  const timestamp = tsPart.split("=")[1]
  const recebida = v1Part.split("=")[1]

  const esperada = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex")

  const a = Buffer.from(esperada)
  const b = Buffer.from(recebida)
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}

import hmac, hashlib

def validar_assinatura(header: str, secret: str, raw_body: str) -> bool:
    ts_part, v1_part = header.split(",")
    timestamp = ts_part.split("=")[1]
    recebida = v1_part.split("=")[1]

    esperada = hmac.new(
        secret.encode("utf-8"),
        f"{timestamp}.{raw_body}".encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()

    return hmac.compare_digest(esperada, recebida)

package webhook

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "strings"
)

func ValidarAssinatura(header, secret, rawBody string) bool {
    parts := strings.Split(header, ",")
    timestamp := strings.SplitN(parts[0], "=", 2)[1]
    recebida := strings.SplitN(parts[1], "=", 2)[1]

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(timestamp + "." + rawBody))
    esperada := hex.EncodeToString(mac.Sum(nil))

    return hmac.Equal([]byte(esperada), []byte(recebida))
}