Alert Authentication

import hmac
import base64
import json

def verify_leaf_signature(raw_body: bytes, secret: str, signature_header: str) -> bool:
    expected_sig = hmac.digest(
        msg=raw_body,
        key=secret.encode("utf-8"),
        digest="sha256"
    )
    request_sig = base64.b64decode(signature_header)
    return hmac.compare_digest(expected_sig, request_sig)

import java.util.Base64;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;

public boolean verifyLeafSignature(byte[] rawBody, String secret, byte[] signatureHeader) throws Exception {
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes(), "HmacSHA256"));
    byte[] expected = mac.doFinal(rawBody);
    return MessageDigest.isEqual(expected, signatureHeader);
}

const crypto = require("crypto");

function verifyLeafSignature(rawBody, secret, signatureHeader) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest();
  const received = Buffer.from(signatureHeader, "base64");
  return crypto.timingSafeEqual(expected, received);
}