Webhooks

X-Workloom-Signature: t=1791002364,v1=3f1c0d…9a2b

// Check that a webhook delivery came from Workloom (Node 18+, no dependencies).
//
// Use the RAW request body, exactly as it arrived. A body parsed to JSON and
// serialised again is not the same bytes, and the signature will not match.
//
//   app.post('/hooks/workloom', express.raw({ type: 'application/json' }), (req, res) => {
//     if (!verifyWorkloom(req.body, req.get('X-Workloom-Signature'), process.env.WORKLOOM_WEBHOOK_SECRET)) {
//       return res.status(400).end();
//     }
//     res.status(200).end();               // answer first...
//     const event = JSON.parse(req.body);  // ...then do the work, once per event.id
//   });
const crypto = require('crypto');

const TOLERANCE_SECONDS = 300;

function verifyWorkloom(rawBody, header, secret, now = Date.now()) {
  const parts = Object.fromEntries(String(header || '').split(',').map((p) => p.split('=')));
  if (!parts.t || !parts.v1) return false;
  if (Math.abs(now / 1000 - Number(parts.t)) > TOLERANCE_SECONDS) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

module.exports = { verifyWorkloom };

"""Check that a webhook delivery came from Workloom (Python 3, standard library only).

Use the RAW request body, exactly as it arrived (Flask: request.get_data(),
Django: request.body). A body parsed to JSON and dumped again is not the same
bytes, and the signature will not match.
"""
import hashlib
import hmac
import time

TOLERANCE_SECONDS = 300


def verify_workloom(raw_body: bytes, header: str, secret: str, now: float | None = None) -> bool:
    try:
        parts = dict(p.split("=", 1) for p in (header or "").split(","))
        t = parts["t"]
        v1 = parts["v1"]
        age = abs((now if now is not None else time.time()) - int(t))
    except (KeyError, ValueError):
        return False
    if age > TOLERANCE_SECONDS:
        return False
    signed = t.encode() + b"." + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)


if __name__ == "__main__":
    import sys

    body, header, secret = sys.argv[1], sys.argv[2], sys.argv[3]
    print("valid" if verify_workloom(body.encode(), header, secret) else "invalid")