Guide
Integration HelpWebhook signature verification in different languages
SA
Sarah Miller
20 days ago
495
3
Here's a comprehensive guide to verifying CredLyr webhook signatures in various languages.
## Why Verify Signatures?
Webhook signatures ensure that requests actually came from CredLyr, not an attacker. Always verify before processing!
## Node.js
```typescript
import crypto from 'crypto';
function verifyWebhookSignature(
payload: string,
signature: string,
secret: string
): boolean {
const expectedSig = crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expectedSig)
);
}
```
## Python
```python
import hmac
import hashlib
def verify_webhook_signature(payload: bytes, signature: str, secret: str) -> bool:
expected = hmac.new(
secret.encode(),
payload,
hashlib.sha256
).hexdigest()
return hmac.compare_digest(signature, expected)
```
## Go
```go
func verifyWebhookSignature(payload []byte, signature, secret string) bool {
mac := hmac.New(sha256.New, []byte(secret))
mac.Write(payload)
expected := hex.EncodeToString(mac.Sum(nil))
return hmac.Equal([]byte(signature), []byte(expected))
}
```
## Common Pitfalls
1. **Using string comparison** - Always use constant-time comparison
2. **Wrong encoding** - Make sure payload is raw bytes, not parsed JSON
3. **Missing timestamp validation** - Check the timestamp header to prevent replay attacks
Hope this helps! Let me know if you need examples in other languages.