Verify webhook requests

export const POST = async (req: Request,res: Response) => {
  const webhookSignature = req.headers.get("X-Dock-Signature");
  if (!webhookSignature) {
    return res.status(401).send("No signature provided.");
  }

  // Copy this from the webhook details page
  const secret = process.env.DOCK_WEBHOOK_SECRET;
  if (!secret) {
    return res.status(401).send("No secret provided.");
  }

  // Make sure to get the body from the request
  const url = `https://${req.header('host')}${req.path}`;
  const body = JSON.stringify(req.body);
  const payload = `${req.method}\n${url}\n${body}`;

  const computedSignature = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");

  if (crypto.timingSafeEqual(
      Buffer.from(webhookSignature, 'hex'),
      Buffer.from(computedSignature, 'hex'),
    )) {
    return res.status(400).send("Invalid signature");
  }

  // Handle the webhook event
  // ...
};

import hmac
import hashlib
import os
from flask import Flask, request, Response

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook_handler():
    webhook_signature = request.headers.get("X-Dock-Signature")
    if not webhook_signature:
        return Response("No signature provided.", status=401)

    secret = os.getenv("DOCK_WEBHOOK_SECRET")
    if not secret:
        return Response("No secret provided.", status=401)

    body = request.get_data(as_text=True)
    url = f"{request.host}{request.path}"
    payload = f"{request.method}\n{url}\n{body}"

    computed_signature = hmac.new(
        secret.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(webhook_signature, computed_signature):
        return Response("Invalid signature.", status=400)

    ## Handle the webhook event
    ## ...

package main

import (
	"bytes"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"net/http"
	"os"
)

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	webhookSignature := r.Header.Get("X-Dock-Signature")
	if webhookSignature == "" {
		http.Error(w, "No signature provided.", http.StatusUnauthorized)
		return
	}

	secret := os.Getenv("DOCK_WEBHOOK_SECRET")
	if secret == "" {
		http.Error(w, "No secret provided.", http.StatusUnauthorized)
		return
	}

	bodyBytes, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "Unable to read request body.", http.StatusInternalServerError)
		return
	}

	// Reconstruct the payload
	url := r.Host + r.URL.Path
	payload := r.Method + "\n" + url + "\n" + string(bodyBytes)

	h := hmac.New(sha256.New, []byte(secret))
	h.Write([]byte(payload))
	computedSignature := hex.EncodeToString(h.Sum(nil))

	if !hmac.Equal([]byte(webhookSignature), []byte(computedSignature)) {
		http.Error(w, "Invalid signature.", http.StatusBadRequest)
		return
	}

	// Handle the webhook event
    //...
}