Webhook：リアルタイムの決済通知

const crypto = require('crypto');

function verifySignature(rawBody, webhookSecretKey, receivedSignature) {
  const expectedSignature = crypto
    .createHmac('sha256', webhookSecretKey)
    .update(rawBody, 'utf8')
    .digest('hex');
  return receivedSignature === expectedSignature;
}

// In your request handler:
const receivedSignature = req.headers['http-webhook-signature'];
const isValid = verifySignature(req.rawBody, process.env.WEBHOOK_SECRET, receivedSignature);

import hmac
import hashlib

def verify_signature(raw_body: str, webhook_secret_key: str, received_signature: str) -> bool:
    expected_signature = hmac.new(
        webhook_secret_key.encode('utf-8'),
        raw_body.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    return received_signature == expected_signature

# In your request handler:
received_signature = request.headers.get('HTTP-WEBHOOK-SIGNATURE')
is_valid = verify_signature(request.get_data(as_text=True), WEBHOOK_SECRET, received_signature)

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;

public boolean verifySignature(String rawBody, String secret, String receivedSignature) throws Exception {
    Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
    SecretKeySpec secretKey = new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
    sha256_HMAC.init(secretKey);
    byte[] hash = sha256_HMAC.doFinal(rawBody.getBytes(StandardCharsets.UTF_8));
    StringBuilder hexString = new StringBuilder();
    for (byte b : hash) {
        String hex = Integer.toHexString(0xff & b);
        if (hex.length() == 1) hexString.append('0');
        hexString.append(hex);
    }
    return hexString.toString().equals(receivedSignature);
}