Verifying a webhook signature

import crypto from "crypto";
import express from "express";

const app = express();
const SECRET = process.env.PRUVA_WEBHOOK_SECRET;

// Capture the RAW body; do not use express.json() before verifying.
app.post("/pruva/webhook", express.raw({ type: "*/*" }), (req, res) => {
  const rawBody = req.body.toString("utf8");
  const timestamp = req.header("X-Pruva-Timestamp");
  const signature = req.header("X-Pruva-Signature");

  // Reject stale deliveries (replay protection).
  const ageSeconds = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!timestamp || ageSeconds > 300) {
    return res.status(400).send("stale or missing timestamp");
  }

  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const ok =
    signature &&
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

  if (!ok) return res.status(401).send("bad signature");

  // Acknowledge first, then do the work.
  res.sendStatus(200);

  const event = JSON.parse(rawBody);
  handleEvent(event);
});

import hmac, hashlib, time, os
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["PRUVA_WEBHOOK_SECRET"]

@app.post("/pruva/webhook")
def webhook():
    raw_body = request.get_data()  # raw bytes, unparsed
    timestamp = request.headers.get("X-Pruva-Timestamp", "")
    signature = request.headers.get("X-Pruva-Signature", "")

    # Replay protection.
    if not timestamp or abs(time.time() - int(timestamp)) > 300:
        abort(400)

    expected = hmac.new(
        SECRET.encode(),
        f"{timestamp}.".encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        abort(401)

    # Acknowledge, then handle.
    event = request.get_json()
    handle_event(event)
    return "", 200

<?php
$secret    = getenv('PRUVA_WEBHOOK_SECRET');
$rawBody   = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_PRUVA_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_PRUVA_SIGNATURE'] ?? '';

// Replay protection.
if ($timestamp === '' || abs(time() - (int)$timestamp) > 300) {
    http_response_code(400);
    exit;
}

$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

http_response_code(200);

$event = json_decode($rawBody, true);
handleEvent($event);