Cryptographic HMAC Signature Verification

const crypto = require('crypto');
function verifySoftymizeWebhook(payloadString, signatureHeader, webhookSecret) {
  // Extract sha256 hash from header
  const expectedHash = signatureHeader.replace('sha256=', '');
  // Calculate HMAC-SHA256 signature
  const calculatedHash = crypto
    .createHmac('sha256', webhookSecret)
    .update(payloadString, 'utf8')
    .digest('hex');
  // Perform timing-safe equality check to prevent timing side-channel attacks
  return crypto.timingSafeEqual(
    Buffer.from(expectedHash, 'hex'),
    Buffer.from(calculatedHash, 'hex')
  );
}

import hmac
import hashlib
def verify_softymize_webhook(payload_bytes, signature_header, secret):
    expected_hash = signature_header.replace("sha256=", "")
    calculated_hash = hmac.new(
        secret.encode('utf-8'),
        payload_bytes,
        hashlib.sha256
    ).hexdigest()
    
    return hmac.compare_digest(expected_hash, calculated_hash)

<?php
function verifySoftymizeWebhook($payloadString, $signatureHeader, $secret) {
    $expectedHash = str_replace('sha256=', '', $signatureHeader);
    $calculatedHash = hash_hmac('sha256', $payloadString, $secret);
    
    return hash_equals($expectedHash, $calculatedHash);
}