HMAC Verification

const crypto = require('crypto')

function verifySignature(rawBody, signatureHeader, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex')

  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expected)
  )
}

// Express — use express.raw() to preserve the raw body
app.post('/webhooks/gatlio', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-gatlio-signature']
  if (!verifySignature(req.body, sig, process.env.GATLIO_WEBHOOK_SECRET)) {
    return res.status(400).send('Invalid signature')
  }

  const payload = JSON.parse(req.body)
  // process payload...
  res.sendStatus(200)
})

import hmac
import hashlib

def verify_signature(raw_body: bytes, signature_header: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        raw_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature_header, expected)

# Flask example
@app.route('/webhooks/gatlio', methods=['POST'])
def gatlio_webhook():
    sig = request.headers.get('X-Gatlio-Signature', '')
    if not verify_signature(request.data, sig, os.environ['GATLIO_WEBHOOK_SECRET']):
        return 'Invalid signature', 400

    payload = request.get_json()
    # process payload...
    return '', 200

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
)

func verifySignature(rawBody []byte, signatureHeader, secret string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(rawBody)
    expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(signatureHeader), []byte(expected))
}