Verifying signatures

import crypto from 'crypto'

// Use the RAW request body (for example express.raw),
// not parsed JSON.
function verifySudoMockWebhook(req, secret) {
  const signature = req.header('X-SudoMock-Signature')
  const timestamp = req.header('X-SudoMock-Timestamp')
  const rawBody = req.body.toString('utf8')

  // Reject replays older than 5 minutes.
  const age = Math.floor(Date.now() / 1000) - Number(timestamp)
  if (!timestamp || Math.abs(age) > 300) return false

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')

  return crypto.timingSafeEqual(
    Buffer.from(signature || '', 'hex'),
    Buffer.from(expected, 'hex')
  )
}

import hmac, hashlib, time

def verify_sudomock_webhook(
    headers,
    raw_body: bytes,
    secret: str,
) -> bool:
    signature = headers.get("X-SudoMock-Signature", "")
    timestamp = headers.get("X-SudoMock-Timestamp", "")

    # Reject replays older than 5 minutes.
    try:
        age = int(time.time()) - int(timestamp)
    except (TypeError, ValueError):
        return False
    if abs(age) > 300:
        return False

    signed_payload = f"{timestamp}.".encode() + raw_body
    expected = hmac.new(
        secret.encode(),
        signed_payload,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(signature, expected)