How Bitbucket Cloud signs webhooks

const crypto = require('node:crypto');

/**
 * Verify a Bitbucket Cloud webhook. rawBody: the request body as a Buffer, exactly as received
 * (before any JSON parsing); headers: lower-case names, as in req.headers.
 */
function verifyWebhook(rawBody, headers, secret, url = '', method = 'POST') {
  rawBody = Buffer.from(rawBody);
  const header = headers['x-hub-signature'] || '';
  if (!header.startsWith('sha256=')) return false;
  const signatures = [header.slice(7)];
  const signed = rawBody;
  const key = secret;
  const expected = crypto.createHmac('sha256', key).update(signed).digest('hex');
  const valid = signatures.some((sig) => {
    const a = Buffer.from(sig.toLowerCase());
    const b = Buffer.from(expected);
    return a.length === b.length && crypto.timingSafeEqual(a, b);
  });
  if (!valid) return false;
  return true;
}

// Express: keep the raw body for this route
// app.post('/webhooks/bitbucket', express.raw({ type: '*/*' }), (req, res) => {
//   if (!verifyWebhook(req.body, req.headers, process.env.BITBUCKET_WEBHOOK_SECRET)) return res.sendStatus(401);
//   res.sendStatus(200); // then process the event asynchronously
// });

import base64
import hashlib
import hmac


def verify_webhook(raw_body: bytes, headers, secret: str, url: str = '', method: str = 'POST') -> bool:
    """Verify a Bitbucket Cloud webhook. raw_body: the request body exactly as received (bytes);
    headers: a mapping with lower-case names (Flask and Django headers are case-insensitive)."""
    header = headers.get('x-hub-signature', '')
    if not header.startswith('sha256='):
        return False
    signatures = [header[7:]]
    signed = raw_body
    key = secret.encode()
    digest = hmac.new(key, signed, hashlib.sha256).digest()
    expected = digest.hex()
    if not any(hmac.compare_digest(sig.lower(), expected) for sig in signatures):
        return False
    return True


# Flask: verify_webhook(request.get_data(), request.headers, SECRET)

<?php

/**
 * Verify a Bitbucket Cloud webhook. $rawBody: file_get_contents('php://input'), before any decoding;
 * $headers: lower-case names, e.g. array_change_key_case(getallheaders()).
 */
function verify_webhook(string $rawBody, array $headers, string $secret, string $url = '', string $method = 'POST'): bool
{
    $header = (string) ($headers['x-hub-signature'] ?? '');
    if (! str_starts_with($header, 'sha256=')) {
        return false;
    }
    $signatures = [substr($header, 7)];
    $signed = $rawBody;
    $key = $secret;
    $expected = hash_hmac('sha256', $signed, $key);
    $valid = false;
    foreach ($signatures as $sig) {
        $valid = $valid || hash_equals($expected, strtolower($sig));
    }

    return $valid;
}

package webhooks

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"net/http"
	"strings"
)

// VerifyWebhook checks a Bitbucket Cloud webhook. rawBody is the request body exactly as received
// (io.ReadAll(r.Body) before any decoding).
func VerifyWebhook(rawBody []byte, h http.Header, secret, url, method string) bool {
	header := h.Get("X-Hub-Signature")
	if !strings.HasPrefix(header, "sha256=") {
		return false
	}
	signatures := []string{strings.TrimPrefix(header, "sha256=")}
	signed := []byte{}
	signed = append(signed, rawBody...)
	key := []byte(secret)
	mac := hmac.New(sha256.New, key)
	mac.Write(signed)
	expected := hex.EncodeToString(mac.Sum(nil))
	valid := false
	for _, sig := range signatures {
		if hmac.Equal([]byte(strings.ToLower(sig)), []byte(expected)) {
			valid = true
		}
	}
	return valid
}