Signing

import crypto from "node:crypto";
import express from "express";

const app = express();

app.post("/webhooks/hooksnode", express.raw({ type: "*/*" }), (req, res) => {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", process.env.HOOKSNODE_SECRET).update(req.body).digest("hex");
  const given = req.get("X-Hooksnode-Signature") ?? "";

  const ok =
    given.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected));
  if (!ok) return res.status(401).end();

  const event = JSON.parse(req.body);
  // Handle the event.
  res.sendStatus(200);
});

import hashlib
import hmac
import os

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["HOOKSNODE_SECRET"].encode()


@app.post("/webhooks/hooksnode")
def hooksnode():
    body = request.get_data()
    expected = "sha256=" + hmac.new(SECRET, body, hashlib.sha256).hexdigest()
    given = request.headers.get("X-Hooksnode-Signature", "")
    if not hmac.compare_digest(given, expected):
        abort(401)
    event = request.get_json()
    # Handle the event.
    return "", 200

func handler(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "bad body", http.StatusBadRequest)
		return
	}
	mac := hmac.New(sha256.New, []byte(os.Getenv("HOOKSNODE_SECRET")))
	mac.Write(body)
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	given := r.Header.Get("X-Hooksnode-Signature")
	if !hmac.Equal([]byte(expected), []byte(given)) {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}
	// Handle the event.
	w.WriteHeader(http.StatusOK)
}

<?php
$body = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $body, getenv('HOOKSNODE_SECRET'));
$given = $_SERVER['HTTP_X_HOOKSNODE_SIGNATURE'] ?? '';

if (!hash_equals($expected, $given)) {
    http_response_code(401);
    exit;
}
$event = json_decode($body, true);
// Handle the event.
http_response_code(200);