Overview

import { Webhook } from "standardwebhooks";

const wh = new Webhook(process.env.NEXUS_WEBHOOK_SECRET.replace("whsec_", ""));

app.post("/webhooks/nexus", express.raw({ type: "application/json" }), (req, res) => {
  try {
    const event = wh.verify(req.body, req.headers);
    queue.add(event);          // process asynchronously
    res.sendStatus(200);
  } catch {
    res.sendStatus(401);
  }
});

from standardwebhooks.webhooks import Webhook

wh = Webhook(os.environ["NEXUS_WEBHOOK_SECRET"].removeprefix("whsec_"))

@app.post("/webhooks/nexus")
def nexus_webhook(request):
    try:
        event = wh.verify(request.body, dict(request.headers))
    except Exception:
        return Response(status=401)
    enqueue(event)
    return Response(status=200)

import crypto from "node:crypto";

function verify(rawBody, headers, secret) {
  const id = headers["webhook-id"];
  const ts = headers["webhook-timestamp"];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const key = Buffer.from(secret.replace("whsec_", ""), "base64");
  const expected = crypto
    .createHmac("sha256", key)
    .update(`${id}.${ts}.${rawBody}`)
    .digest("base64");

  return headers["webhook-signature"].split(" ").some((sig) => {
    const value = sig.split(",")[1] ?? "";
    return value.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(value), Buffer.from(expected));
  });
}