Webhooks

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyVozonSignature(rawBodyBuffer, signatureHeader, endpointSecret) {
  const expected = createHmac("sha256", endpointSecret)
    .update(rawBodyBuffer)
    .digest("hex");
  const received = signatureHeader.replace(/^v1=/, "");
  return (
    expected.length === received.length &&
    timingSafeEqual(Buffer.from(expected), Buffer.from(received))
  );
}

import hmac
import hashlib

def verify_vozon_signature(raw_body_bytes, signature_header, endpoint_secret):
    expected = hmac.new(
        endpoint_secret.encode('utf-8'),
        raw_body_bytes,
        hashlib.sha256
    ).hexdigest()
    received = signature_header.removeprefix("v1=")
    return hmac.compare_digest(expected, received)

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"strings"
)

func VerifyVozonSignature(rawBody []byte, signatureHeader string, secret string) bool {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write(rawBody)
	expected := hex.EncodeToString(mac.Sum(nil))
	received := strings.TrimPrefix(signatureHeader, "v1=")
	return hmac.Equal([]byte(expected), []byte(received))
}