Verifying signatures

import crypto from "node:crypto";

const TOLERANCE_SECONDS = 5 * 60;

// rawBody must be the unparsed request body (a Buffer or string).
export function verifyKycWebhook(secret, headers, rawBody) {
  const id = headers["webhook-id"];
  const timestamp = headers["webhook-timestamp"];
  const signatures = headers["webhook-signature"];

  if (!id || !timestamp || !signatures) {
    return false;
  }

  const sentAt = Number(timestamp);
  const now = Math.floor(Date.now() / 1000);

  if (!Number.isInteger(sentAt) || Math.abs(now - sentAt) > TOLERANCE_SECONDS) {
    return false;
  }

  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = crypto
    .createHmac("sha256", key)
    .update(`${id}.${timestamp}.`)
    .update(rawBody)
    .digest();

  return signatures.split(" ").some((signature) => {
    const [version, value] = signature.split(",");

    if (version !== "v1" || !value) {
      return false;
    }

    const received = Buffer.from(value, "base64");

    return received.length === expected.length && crypto.timingSafeEqual(received, expected);
  });
}

// Express: keep the raw body for this route.
// app.post("/kyc-webhooks", express.raw({ type: "application/json" }), (req, res) => {
//   if (!verifyKycWebhook(process.env.KYC_WEBHOOK_SECRET, req.headers, req.body)) {
//     return res.sendStatus(400);
//   }
//   queueForProcessing(req.body);
//   res.sendStatus(204);
// });

<?php

const KYC_WEBHOOK_TOLERANCE_SECONDS = 300;

function verifyKycWebhook(string $secret, string $id, string $timestamp, string $signatures, string $rawBody): bool
{
    if (! ctype_digit($timestamp) || abs(time() - (int) $timestamp) > KYC_WEBHOOK_TOLERANCE_SECONDS) {
        return false;
    }

    $key = base64_decode(preg_replace('/^whsec_/', '', $secret), true);

    if ($key === false) {
        return false;
    }

    $expected = base64_encode(hash_hmac('sha256', "{$id}.{$timestamp}.{$rawBody}", $key, true));

    foreach (explode(' ', $signatures) as $signature) {
        [$version, $value] = array_pad(explode(',', $signature, 2), 2, '');

        if ($version === 'v1' && hash_equals($expected, $value)) {
            return true;
        }
    }

    return false;
}

$valid = verifyKycWebhook(
    getenv('KYC_WEBHOOK_SECRET'),
    $_SERVER['HTTP_WEBHOOK_ID'] ?? '',
    $_SERVER['HTTP_WEBHOOK_TIMESTAMP'] ?? '',
    $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '',
    file_get_contents('php://input'),
);