HEADER
HEADER = 'X-Strata-Signature'
Header the signature travels in.
Signs and verifies a webhook body.
The signature covers the timestamp AND the body, joined by a separator that cannot appear in the timestamp. Signing the body alone would let anyone who captured one delivery replay it forever; signing them concatenated without a separator would let a body starting with digits be traded against the timestamp for the same digest.
Verification is constant-time and bounded in age. A receiver that skipped the age check would accept a replay of a genuine delivery from any point in the past, which is the whole reason the timestamp is in the signed material.
sign(string $body, string $secret, int $timestamp) : string
The header value for a body.
| string | $body | The exact bytes that will be sent. |
| string | $secret | The shared secret. |
| int | $timestamp | Unix seconds the delivery was signed at. |
A header value of the form t=<unix>,v1=<hex>.
verify(string $header, string $body, string $secret, int $now, int $tolerance = \self::DEFAULT_TOLERANCE) : bool
Whether a header value authenticates a body.
| string | $header | The received header value. |
| string | $body | The received body. |
| string | $secret | The shared secret. |
| int | $now | Unix seconds to measure age against. |
| int | $tolerance | Seconds of age to accept. |
TRUE when the signature matches and is inside the tolerance.