Webhook security

<?php
$webhook_secret = 'your-webhook-secret';
$req_headers = getallheaders();
$signature = $req_headers['X-Xmenu-Signature'];
$payload = file_get_contents('php://input');
$calc_hmac = hash_hmac('sha256', $payload, $webhook_secret);

if ($signature !== $calc_hmac) {
    header('HTTP/1.0 401 Unauthorized');
    exit('Webhook signature is not valid!');
}

$data = json_decode($payload);
// Process the webhook notification

const crypto = require('crypto');

function verifyWebhook(req, res, next) {
    const webhookSecret = 'your-webhook-secret';
    const signature = req.headers['x-xmenu-signature'];
    const payload = JSON.stringify(req.body);
    const calcHmac = crypto
        .createHmac('sha256', webhookSecret)
        .update(payload)
        .digest('hex');

    if (signature !== calcHmac) {
        return res.status(401).send('Webhook signature is not valid!');
    }

    next();
}

import hmac
import hashlib
from flask import request, abort

WEBHOOK_SECRET = 'your-webhook-secret'

def verify_webhook():
    signature = request.headers.get('X-Xmenu-Signature')
    payload = request.get_data()
    calc_hmac = hmac.new(
        WEBHOOK_SECRET.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()

    if signature != calc_hmac:
        abort(401, 'Webhook signature is not valid!')

using System.Security.Cryptography;
using System.Text;

public bool VerifyWebhook(string payload, string signature)
{
    var webhookSecret = "your-webhook-secret";
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(webhookSecret));
    var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
    var calcHmac = Convert.ToHexString(hash).ToLower();

    return signature == calcHmac;
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "net/http"
)

func verifyWebhook(r *http.Request, payload []byte) bool {
    webhookSecret := "your-webhook-secret"
    signature := r.Header.Get("X-Xmenu-Signature")

    mac := hmac.New(sha256.New, []byte(webhookSecret))
    mac.Write(payload)
    calcHmac := hex.EncodeToString(mac.Sum(nil))

    return signature == calcHmac
}