Verifying signatures

const crypto = require('crypto');
const express = require('express');

const app = express();

// Keep the raw bytes — the signature is over these, not the parsed object.
app.use(express.json({ verify: (req, res, buf) => { req.rawBody = buf; } }));

function verifyTrailerCast(req, secret, toleranceSeconds = 300) {
  const header = req.get('X-TrailerCast-Signature') || '';
  const parts = Object.fromEntries(header.split(',').map((p) => p.trim().split('=')));
  const t = Number(parts.t);
  if (!Number.isFinite(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;

  const expected = crypto.createHmac('sha256', secret)
    .update(`${t}.`).update(req.rawBody).digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post('/hooks/trailercast', (req, res) => {
  if (!verifyTrailerCast(req, process.env.TRAILERCAST_WEBHOOK_SECRET)) {
    return res.status(401).end();
  }
  const event = req.body;              // { id, type, data, … }
  queue.push(event);                   // do the real work off the request
  res.status(200).end();
});

import hmac, hashlib, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["TRAILERCAST_WEBHOOK_SECRET"].encode()

def verify(raw_body: bytes, header: str, tolerance: int = 300) -> bool:
    parts = dict(p.strip().split("=", 1) for p in header.split(",") if "=" in p)
    try:
        t = int(parts["t"]); v1 = parts["v1"]
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(SECRET, f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

@app.post("/hooks/trailercast")
def hook():
    if not verify(request.get_data(), request.headers.get("X-TrailerCast-Signature", "")):
        abort(401)
    event = request.get_json()
    enqueue(event)
    return "", 200

func verifyTrailerCast(rawBody []byte, header, secret string, tolerance time.Duration) bool {
    var ts int64
    var sig string
    for _, part := range strings.Split(header, ",") {
        kv := strings.SplitN(strings.TrimSpace(part), "=", 2)
        if len(kv) != 2 { continue }
        switch kv[0] {
        case "t":  ts, _ = strconv.ParseInt(kv[1], 10, 64)
        case "v1": sig = kv[1]
        }
    }
    if ts == 0 || sig == "" { return false }
    if d := time.Since(time.Unix(ts, 0)); d > tolerance || d < -tolerance { return false }

    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(strconv.FormatInt(ts, 10) + "."))
    mac.Write(rawBody)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(expected), []byte(sig))
}