HMAC signature verification

import hmac
import hashlib
import time

def verify_docketlayer_callback(
    secret: str,
    raw_body: bytes,
    signature_header: str,
    timestamp_header: str,
    max_age_seconds: int = 300
) -> bool:
    # Reject stale deliveries to prevent replay attacks
    try:
        delivery_time = int(timestamp_header)
    except (TypeError, ValueError):
        return False
    if abs(time.time() - delivery_time) > max_age_seconds:
        return False

    # Compute expected signature
    expected = "sha256=" + hmac.new(
        secret.encode(),
        raw_body,
        hashlib.sha256
    ).hexdigest()

    # Constant-time comparison prevents timing attacks
    return hmac.compare_digest(expected, signature_header)

import crypto from "crypto";

function verifyDocketLayerCallback(
  secret,
  rawBody,
  signatureHeader,
  timestampHeader,
  maxAgeSeconds = 300
) {
  // Reject stale deliveries
  const deliveryTime = parseInt(timestampHeader, 10);
  if (Math.abs(Date.now() / 1000 - deliveryTime) > maxAgeSeconds) {
    return false;
  }

  // Compute expected signature
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");

  // Constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}