Verify Webhook

using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

public static class WebhookSecurity
{
    /// <summary>
    /// Computes an HMAC-SHA512 signature for a payload string.
    /// </summary>
    public static string ComputeSignature(string payload, string secret)
    {
        byte[] secretBytes = Encoding.UTF8.GetBytes(secret);
        byte[] payloadBytes = Encoding.UTF8.GetBytes(payload);

        using (var hmac = new HMACSHA512(secretBytes))
        {
            byte[] hashBytes = hmac.ComputeHash(payloadBytes);
            return Convert.ToHexString(hashBytes).ToLowerInvariant();
        }
    }

    /// <summary>
    /// Verifies an incoming HMAC-SHA512 header signature against the raw payload string.
    /// </summary>
    public static bool VerifySignature(string payload, string secret, string headerSignature)
    {
        if (string.IsNullOrEmpty(payload) || string.IsNullOrEmpty(secret) || string.IsNullOrEmpty(headerSignature))
            return false;

        string computedSignature = ComputeSignature(payload, secret);
        byte[] computedBytes = Encoding.UTF8.GetBytes(computedSignature);
        byte[] headerBytes = Encoding.UTF8.GetBytes(headerSignature.ToLowerInvariant());

        return CryptographicOperations.FixedTimeEquals(computedBytes, headerBytes);
    }
}

<?php

class WebhookSecurity
{
    /**
     * Computes an HMAC-SHA512 signature.
     */
    public static function computeSignature(string $payload, string $secret): string
    {
        return hash_hmac('sha512', $payload, $secret);
    }

    /**
     * Verifies the signature using a timing-safe comparison.
     */
    public static function verifySignature(string $payload, string $secret, string $headerSignature): bool
    {
        if (empty($payload) || empty($secret) || empty($headerSignature)) {
            return false;
        }

        $computedSignature = self::computeSignature($payload, $secret);
        return hash_equals($computedSignature, strtolower($headerSignature));
    }
}
?>

const crypto = require('crypto');

class WebhookSecurity {
    /**
     * Computes an HMAC-SHA512 signature.
     */
    static computeSignature(payload, secret) {
        return crypto
            .createHmac('sha512', secret)
            .update(payload, 'utf8')
            .digest('hex');
    }

    /**
     * Verifies the signature using timing-safe buffer comparison.
     */
    static verifySignature(payload, secret, headerSignature) {
        if (!payload || !secret || !headerSignature) {
            return false;
        }

        const computedSignature = this.computeSignature(payload, secret);
        const computedBuffer = Buffer.from(computedSignature, 'utf8');
        const headerBuffer = Buffer.from(headerSignature.toLowerCase(), 'utf8');

        if (computedBuffer.length !== headerBuffer.length) {
            return false;
        }

        return crypto.timingSafeEqual(computedBuffer, headerBuffer);
    }
}

module.exports = WebhookSecurity;