{
  "sub": "84f4cf12-3a8c-4b77-9a8f-b2f7e3d9e1aa",
  "payload_hash": "5f3d2b1c9e7a4f8b...",
  "iss": "spidr-webhook-deliverer",
  "iat": 1761840000,
  "exp": 1761840300
}

const crypto = require('crypto');
const jwt = require('jsonwebtoken');

function verifySpidrWebhook(rawBody, authHeader, secret) {
  if (!authHeader?.startsWith('Bearer ')) {
    throw new Error('Missing or malformed Authorization header');
  }
  const token = authHeader.slice('Bearer '.length);

  // Throws on bad signature, expired token, or wrong issuer.
  // clockTolerance gives 30s of slack for NTP drift on either side.
  const claims = jwt.verify(token, secret, {
    algorithms: ['HS256'],
    issuer: 'spidr-webhook-deliverer',
    clockTolerance: 30,
  });

  // Bind the body to the token
  const expectedHash = crypto.createHash('sha256').update(rawBody).digest('hex');
  const a = Buffer.from(expectedHash, 'hex');
  const b = Buffer.from(claims.payload_hash, 'hex');
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    throw new Error('payload_hash mismatch');
  }

  return claims; // { sub, payload_hash, iss, iat, exp }
}

const express = require('express');
const app = express();

// IMPORTANT: capture the raw body — do not let express.json() parse first.
// Spidr always sends Content-Type: application/json. We use type: '*/*' here
// to be defensive against upstream proxies that rewrite the Content-Type.
app.post(
  '/webhook',
  express.raw({ type: '*/*' }),
  (req, res) => {
    try {
      const rawBody = req.body.toString('utf8');
      verifySpidrWebhook(rawBody, req.headers.authorization, process.env.SPIDR_WEBHOOK_SECRET);
      const payload = JSON.parse(rawBody);
      // process payload...
      res.status(200).send('OK');
    } catch (err) {
      res.status(401).send(err.message);
    }
  },
);

import hashlib
import hmac
import jwt  # PyJWT

ISSUER = "spidr-webhook-deliverer"

def verify_spidr_webhook(raw_body: bytes, auth_header: str, secret: str) -> dict:
    if not auth_header or not auth_header.startswith("Bearer "):
        raise ValueError("Missing or malformed Authorization header")
    token = auth_header[len("Bearer "):]

    # Validates signature, exp, and iss. leeway=30 gives slack for NTP drift.
    claims = jwt.decode(
        token,
        secret,
        algorithms=["HS256"],
        issuer=ISSUER,
        leeway=30,
    )

    expected_hash = hashlib.sha256(raw_body).hexdigest()
    if not hmac.compare_digest(expected_hash, claims["payload_hash"]):
        raise ValueError("payload_hash mismatch")

    return claims

from flask import Flask, request, abort
import os

app = Flask(__name__)

@app.route("/webhook", methods=["POST"])
def webhook():
    raw_body = request.get_data()  # bytes, before any JSON parsing
    try:
        verify_spidr_webhook(raw_body, request.headers.get("Authorization"), os.environ["SPIDR_WEBHOOK_SECRET"])
    except Exception as e:
        abort(401, str(e))

    payload = request.get_json()
    # process payload...
    return "OK", 200

package main

import (
    "crypto/sha256"
    "crypto/subtle"
    "encoding/hex"
    "errors"
    "fmt"
    "strings"
    "time"

    "github.com/golang-jwt/jwt/v5"
)

const issuer = "spidr-webhook-deliverer"

type spidrClaims struct {
    PayloadHash string `json:"payload_hash"`
    jwt.RegisteredClaims
}

func verifySpidrWebhook(rawBody []byte, authHeader, secret string) (*spidrClaims, error) {
    if !strings.HasPrefix(authHeader, "Bearer ") {
        return nil, errors.New("missing or malformed Authorization header")
    }
    tokenStr := strings.TrimPrefix(authHeader, "Bearer ")

    parser := jwt.NewParser(
        jwt.WithValidMethods([]string{"HS256"}),
        jwt.WithIssuer(issuer),
        jwt.WithExpirationRequired(),
        jwt.WithLeeway(30*time.Second),
    )

    claims := &spidrClaims{}
    _, err := parser.ParseWithClaims(tokenStr, claims, func(t *jwt.Token) (interface{}, error) {
        return []byte(secret), nil
    })
    if err != nil {
        return nil, fmt.Errorf("jwt verify failed: %w", err)
    }

    sum := sha256.Sum256(rawBody)
    expected := hex.EncodeToString(sum[:])
    if subtle.ConstantTimeCompare([]byte(expected), []byte(claims.PayloadHash)) != 1 {
        return nil, errors.New("payload_hash mismatch")
    }

    return claims, nil
}

require 'jwt'
require 'digest'
require 'openssl'

ISSUER = 'spidr-webhook-deliverer'

def verify_spidr_webhook(raw_body, auth_header, secret)
  raise 'Missing or malformed Authorization header' unless auth_header&.start_with?('Bearer ')
  token = auth_header.sub(/\ABearer /, '')

  payload, _header = JWT.decode(
    token,
    secret,
    true,
    algorithm: 'HS256',
    iss: ISSUER,
    verify_iss: true,
    verify_expiration: true,
    leeway: 30,
  )

  expected = Digest::SHA256.hexdigest(raw_body)
  raise 'payload_hash mismatch' unless OpenSSL.fixed_length_secure_compare(expected, payload['payload_hash'])

  payload
end