Verify webhooks

import crypto from "node:crypto";

function isValidSignature(req) {
  const received = Buffer.from(req.get("X-Webhook-Signature") ?? "");
  const expected = Buffer.from(process.env.TANDA_WEBHOOK_SECRET);
  return received.length === expected.length && crypto.timingSafeEqual(received, expected);
}

app.post("/webhooks/tanda", express.json(), (req, res) => {
  if (!isValidSignature(req)) return res.sendStatus(401);
  queue.add("tanda-event", req.body);
  res.sendStatus(200);
});

import hmac, os
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["TANDA_WEBHOOK_SECRET"]

@app.post("/webhooks/tanda")
def tanda_webhook():
    received = request.headers.get("X-Webhook-Signature", "")
    if not hmac.compare_digest(received, SECRET):
        abort(401)
    enqueue(request.get_json())
    return "", 200

<?php
$secret   = getenv('TANDA_WEBHOOK_SECRET');
$received = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

if (!hash_equals($secret, $received)) {
    http_response_code(401);
    exit;
}

enqueue(json_decode(file_get_contents('php://input'), true));
http_response_code(200);