Webhook events

import crypto from 'node:crypto';

export function verifyGuildWebhook(signatureHeader, rawBody, secret) {
  if (!signatureHeader) return false;

  const parts = Object.fromEntries(
    signatureHeader.split(',').map((p) => p.split('=', 2))
  );
  const t = parseInt(parts.t, 10);
  const v1 = parts.v1;
  if (!t || !v1) return false;

  if (Math.abs(Math.floor(Date.now() / 1000) - t) > 300) return false;

  const body = Buffer.isBuffer(rawBody) ? rawBody.toString('utf8') : rawBody;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${body}`)
    .digest('hex');

  try {
    return crypto.timingSafeEqual(
      Buffer.from(expected, 'hex'),
      Buffer.from(v1, 'hex')
    );
  } catch {
    return false;
  }
}

import hmac
import hashlib
import time


def verify_guild_webhook(signature_header: str, raw_body: bytes, secret: str) -> bool:
    if not signature_header:
        return False
    try:
        parts = dict(pair.split("=", 1) for pair in signature_header.split(","))
        t = int(parts["t"])
        v1 = parts["v1"]
    except (ValueError, KeyError):
        return False

    if abs(time.time() - t) > 300:
        return False

    signed = f"{t}.".encode("utf-8") + raw_body
    expected = hmac.new(secret.encode("utf-8"), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

<?php

function verifyGuildWebhook(?string $signatureHeader, string $rawBody, string $secret): bool
{
    if (empty($signatureHeader)) return false;

    $parts = [];
    foreach (explode(',', $signatureHeader) as $pair) {
        $kv = explode('=', $pair, 2);
        if (count($kv) === 2) $parts[$kv[0]] = $kv[1];
    }
    if (!isset($parts['t'], $parts['v1'])) return false;

    $t = (int) $parts['t'];
    if (abs(time() - $t) > 300) return false;

    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    return hash_equals($expected, $parts['v1']);
}

using System;
using System.Collections.Generic;
using System.Security.Cryptography;
using System.Text;

public static class GuildWebhookVerifier
{
    public static bool Verify(string? signatureHeader, string rawBody, string secret)
    {
        if (string.IsNullOrEmpty(signatureHeader)) return false;

        var parts = new Dictionary<string, string>();
        foreach (var pair in signatureHeader.Split(','))
        {
            var kv = pair.Split('=', 2);
            if (kv.Length == 2) parts[kv[0]] = kv[1];
        }
        if (!parts.TryGetValue("t", out var tStr) ||
            !parts.TryGetValue("v1", out var v1) ||
            !long.TryParse(tStr, out var t))
            return false;

        var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
        if (Math.Abs(now - t) > 300) return false;

        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes($"{t}.{rawBody}"));
        var expected = Convert.ToHexString(hash).ToLowerInvariant();

        return CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(expected),
            Encoding.UTF8.GetBytes(v1));
    }
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.HashMap;
import java.util.Map;

public final class GuildWebhookVerifier {
    public static boolean verify(String signatureHeader, String rawBody, String secret) {
        if (signatureHeader == null || signatureHeader.isEmpty()) return false;

        Map<String, String> parts = new HashMap<>();
        for (String pair : signatureHeader.split(",")) {
            String[] kv = pair.split("=", 2);
            if (kv.length == 2) parts.put(kv[0], kv[1]);
        }
        String tStr = parts.get("t");
        String v1 = parts.get("v1");
        if (tStr == null || v1 == null) return false;

        long t;
        try { t = Long.parseLong(tStr); } catch (NumberFormatException e) { return false; }

        long now = System.currentTimeMillis() / 1000L;
        if (Math.abs(now - t) > 300) return false;

        try {
            Mac mac = Mac.getInstance("HmacSHA256");
            mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
            byte[] hash = mac.doFinal((t + "." + rawBody).getBytes(StandardCharsets.UTF_8));

            StringBuilder hex = new StringBuilder(hash.length * 2);
            for (byte b : hash) hex.append(String.format("%02x", b));

            return MessageDigest.isEqual(
                hex.toString().getBytes(StandardCharsets.UTF_8),
                v1.getBytes(StandardCharsets.UTF_8));
        } catch (Exception e) {
            return false;
        }
    }
}