Overview

    #!/bin/bash
    PAYLOAD='<Webhook HTTP request body>'
    BASE64_SECRET='<Your webhook secret>'
    PROVIDED_SIG='sha256=... <signature from request header>'
    CALCULATED=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$(echo -n "$BASE64_SECRET" | base64 -d)" | cut -d' ' -f2)
    EXPECTED=$(echo "$PROVIDED_SIG" | cut -d'=' -f2)
    echo "Calculated: $CALCULATED"
    echo "Expected  : $EXPECTED"
    if [ "$CALCULATED" = "$EXPECTED" ]; then
        echo "Valid"
    else
        echo "Invalid"
    fi

    [HttpPost]
    public IActionResult Webhook([FromBody] string payload)
    {
        string signature = Request.Headers["X-Volley-Signature"];
        string secret = Configuration["WebhookSecret"];

        if (WebhookValidator.ValidateWebhook(payload, secret, signature))
        {
            // Process webhook
            return Ok();
        }

        return Unauthorized();
    }

    public static class WebhookValidator
    {
        public static bool ValidateWebhook(string payload, string base64Secret, string providedSignature)
        {
            try
            {
                byte[] secretKey = Convert.FromBase64String(base64Secret);

                using (var hmac = new HMACSHA256(secretKey))
                {
                    byte[] payloadBytes = Encoding.UTF8.GetBytes(payload);
                    byte[] hash = hmac.ComputeHash(payloadBytes);
                    string calculated = Convert.ToHexString(hash).ToLowerInvariant();

                    string expected = providedSignature.StartsWith("sha256=")
                        ? providedSignature.Substring(7)
                        : providedSignature;

                    return calculated == expected;
                }
            }
            catch
            {
                return false;
            }
        }
    }

    func webhookHandler(w http.ResponseWriter, r *http.Request) {
        body, _ := io.ReadAll(r.Body)
        payload := string(body)

        signature := r.Header.Get("X-Volley-Signature")
        secret := os.Getenv("WEBHOOK_SECRET")

        if validateWebhook(payload, secret, signature) {
            processWebhook(payload)
            w.WriteHeader(http.StatusOK)
            return
        }

        w.WriteHeader(http.StatusUnauthorized)
    }

    func validateWebhook(payload, base64Secret, providedSignature string) bool {
        secretKey, err := base64.StdEncoding.DecodeString(base64Secret)
        if err != nil {
            return false
        }

        h := hmac.New(sha256.New, secretKey)
        h.Write([]byte(payload))
        calculated := hex.EncodeToString(h.Sum(nil))

        expected := providedSignature
        if strings.HasPrefix(providedSignature, "sha256=") {
            expected = providedSignature[7:]
        }

        return hmac.Equal([]byte(calculated), []byte(expected))
    }

    func processWebhook(payload string) {
        println("Processing webhook:", payload)
    }

    class WebhookController < ApplicationController
      skip_before_action :verify_authenticity_token

      def receive
        payload = request.body.read
        signature = request.headers['X-Volley-Signature']
        secret = ENV['WEBHOOK_SECRET']

        if WebhookValidator.validate(payload, secret, signature)
          process_webhook(payload)
          head :ok
        else
          head :unauthorized
        end
      end

      private

      def process_webhook(payload)
        Rails.logger.info "Processing webhook: #{payload}"
      end
    end

    class WebhookValidator
      def self.validate(payload, base64_secret, provided_signature)
        return false if base64_secret.nil? || provided_signature.nil?

        begin
          secret_key = Base64.decode64(base64_secret)
          calculated = OpenSSL::HMAC.hexdigest('sha256', secret_key, payload)

          expected = provided_signature.start_with?('sha256=') ?
                     provided_signature[7..-1] :
                     provided_signature

          OpenSSL.fixed_length_secure_compare(calculated, expected)
        rescue
          false
        end
      end
    end

    const express = require('express');
    const crypto = require('crypto');
    const app = express();

    app.use('/webhook', express.raw({ type: 'application/json' }));

    app.post('/webhook', (req, res) => {
      const payload = req.body.toString();
      const signature = req.headers['x-volley-signature'];
      const secret = process.env.WEBHOOK_SECRET;

      if (validateWebhook(payload, secret, signature)) {
        processWebhook(payload);
        res.status(200).send('OK');
      } else {
        res.status(401).send('Unauthorized');
      }
    });

    function validateWebhook(payload, base64Secret, providedSignature) {
      if (!base64Secret || !providedSignature) return false;

      try {
        const secretKey = Buffer.from(base64Secret, 'base64');
        const calculated = crypto.createHmac('sha256', secretKey)
          .update(payload, 'utf8')
          .digest('hex');

        const expected = providedSignature.startsWith('sha256=')
          ? providedSignature.substring(7)
          : providedSignature;

        return crypto.timingSafeEqual(
          Buffer.from(calculated),
          Buffer.from(expected)
        );
      } catch {
        return false;
      }
    }

    function processWebhook(payload) {
      console.log('Processing webhook:', payload);
    }