Branche n’importe quel entrepôt sur ProfitDesk.

import crypto from "node:crypto";

function verify(rawBody, headers, secret) {
  const ts = headers["x-webhook-timestamp"];
  const signature = headers["x-webhook-signature"];
  if (!ts || !signature || !/^\d+$/.test(ts)) return false;
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
  return signature.split(",").some((sig) => {
    const a = Buffer.from(sig.trim()), b = Buffer.from(expected);
    return a.length === b.length && crypto.timingSafeEqual(a, b);
  });
}

import hashlib, hmac, time

def verify(raw_body: bytes, headers, secret: str) -> bool:
    ts = headers.get("X-Webhook-Timestamp", "")
    signature = headers.get("X-Webhook-Signature", "")
    if not ts.isdigit() or not signature:
        return False
    if abs(time.time() - int(ts)) > 300:
        return False
    expected = "sha256=" + hmac.new(secret.encode(), ts.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(sig.strip(), expected) for sig in signature.split(","))

function verify(string $rawBody, array $headers, string $secret): bool {
    $ts = $headers['X-Webhook-Timestamp'] ?? '';
    $signature = $headers['X-Webhook-Signature'] ?? '';
    if (!ctype_digit($ts) || $signature === '') return false;
    if (abs(time() - (int)$ts) > 300) return false;
    $expected = 'sha256=' . hash_hmac('sha256', $ts . '.' . $rawBody, $secret);
    foreach (explode(',', $signature) as $sig) {
        if (hash_equals($expected, trim($sig))) return true;
    }
    return false;
}

func verify(rawBody []byte, h http.Header, secret string) bool {
	ts := h.Get("X-Webhook-Timestamp")
	sec, err := strconv.ParseInt(ts, 10, 64)
	if err != nil || math.Abs(float64(time.Now().Unix()-sec)) > 300 {
		return false
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(ts + "."))
	mac.Write(rawBody)
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	for _, sig := range strings.Split(h.Get("X-Webhook-Signature"), ",") {
		if hmac.Equal([]byte(strings.TrimSpace(sig)), []byte(expected)) {
			return true
		}
	}
	return false
}