Webhook de mudança de status

const crypto = require('crypto');

// rawBody: string/Buffer com o corpo cru; signature: header X-Hubcred-Signature
function isValidSignature(rawBody, signature, secret) {
 const expected =
 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
 const a = Buffer.from(expected);
 const b = Buffer.from(signature || '');
 // comparação em tempo constante evita timing attacks
 return a.length === b.length && crypto.timingSafeEqual(a, b);
}

import hmac, hashlib

def is_valid_signature(raw_body: bytes, signature: str, secret: str) -> bool:
 expected = "sha256=" + hmac.new(
 secret.encode("utf-8"), raw_body, hashlib.sha256
 ).hexdigest()
 return hmac.compare_digest(expected, signature or "")

using System.Security.Cryptography;
using System.Text;

bool IsValidSignature(string rawBody, string signature, string secret)
{
 using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
 var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(rawBody));
 var expected = "sha256=" + Convert.ToHexString(hash).ToLowerInvariant();
 return CryptographicOperations.FixedTimeEquals(
 Encoding.UTF8.GetBytes(expected),
 Encoding.UTF8.GetBytes(signature ?? string.Empty));
}