Webhook Verify (Python)

type

item

files

2

registry deps

none

npm deps

none

• ①Slack v0 and Standard Webhooks (Svix, Fathom), both fail closed: a bad or missing anything is False, never an exception
• ②Every compare is hmac.compare_digest — the shipped test pins it with a spy, plus the exact 300 s boundary
• ③Verify the raw request bytes, never re-serialised JSON — the one integration bug this item cannot catch for you

Slack: verify_slack_request(secret, request.headers, body). Standard Webhooks (Svix, Fathom — the webhook-id / webhook-timestamp / webhook-signature trio): verify_standard_webhook_request(secret, request.headers, body); any one of the space-separated v1,<base64> entries matching passes, which is what keeps deliveries verifiable during a secret rotation, and the whsec_ prefix is optional. Lower-level verify_slack(...) / verify_standard_webhook(...) take the header values directly. **body must be the raw bytes off the wire** (await request.body()), never re-serialised JSON — that reorders keys and fails every delivery with nothing but "bad signature" to go on. Every verifier fails closed and never raises on attacker input: missing secret or header, non-numeric, stale or future timestamp beyond TOLERANCE_SECONDS, malformed signature all return False, so the handler answers 401 on one boolean. Every comparison is hmac.compare_digest; the shipped test pins that with a spy, plus the exact tolerance boundary and a known-answer vector computed from the spec. sign_slack / sign_standard_webhook are exported so your own tests can build known-good headers. No env vars: which name holds which sender's secret is the app's choice, so the secret is a parameter. Stdlib only.