WebhookVerifier.php

<?php

namespace Fingerprint\ServerAPI\Webhook;

/**
 * Verifies Fingerprint webhook signature.
 */
final class WebhookVerifier
{
    /**
     * Checks whether the webhook signature header is valid for the given data and secret.
     *
     * @param string $header comma-separated list of versioned signatures
     * @param string $data   raw webhook request body
     * @param string $secret webhook signing secret
     */
    public static function IsValidWebhookSignature(string $header, string $data, string $secret): bool
    {
        $signatures = explode(',', $header);
        foreach ($signatures as $signature) {
            $parts = explode('=', $signature);
            if (2 === count($parts) && 'v1' === $parts[0]) {
                $hash = $parts[1];
                if (self::checkSignature($hash, $data, $secret)) {
                    return true;
                }
            }
        }

        return false;
    }

    /**
     * Compares the given signature against an HMAC-SHA256 hash of the data.
     */
    private static function checkSignature(string $signature, string $data, string $secret): bool
    {
        $hash = hash_hmac('sha256', $data, $secret);

        return hash_equals($hash, $signature);
    }
}