13 lines
529 B
Python
13 lines
529 B
Python
import hashlib
|
|
import hmac
|
|
|
|
|
|
def verify_meta_signature(app_secret: str, raw_body: bytes, signature_header: str | None) -> bool:
|
|
"""Validate X-Hub-Signature-256 from Meta webhook POSTs."""
|
|
if not app_secret or not signature_header:
|
|
return False
|
|
if not signature_header.startswith("sha256="):
|
|
return False
|
|
expected = signature_header.removeprefix("sha256=")
|
|
computed = hmac.new(app_secret.encode("utf-8"), raw_body, hashlib.sha256).hexdigest()
|
|
return hmac.compare_digest(computed, expected)
|