INNER CODE UNIT · Python
is_valid_chatwoot_signature
arc53/DocsGPT · extensions/chatwoot/app.py:112
def is_valid_chatwoot_signature(
raw_body: bytes, signature_header: str | None, timestamp_header: str | None
) -> bool:
"""Validate a Chatwoot webhook signature.
Chatwoot signs each delivery with ``sha256=HMAC-SHA256(secret, "{timestamp}.{raw_body}")`` and sends the
timestamp in ``X-Chatwoot-Timestamp``. When ``chatwoot_allow_unsigned`` is on, a request with neither header
is accepted; a request that carries either header is still verified.
Args:
raw_body: The unparsed request body.
signature_header: The ``X-Chatwoot-Signature`` header value.
timestamp_header: The ``X-Chatwoot-Timestamp`` header value (Unix seconds).
Returns:
True if the signature matches and the timestamp is recent, or the request is unsigned and unsigned
requests are allowed.
"""