Use hash_equals when validating webhook signature

[thinkverse]

The use of !== over hash_equals was bothering me, not sure if the validation needs a timing-safe string comparison but better safe than sorry. It is also the way Lemon Squeezy uses in their example:

$secret    = '[SIGNING_SECRET]'; // from your webhook settings
$payload   = file_get_contents('php://input');
$hash      = hash_hmac('sha256', $payload, $secret);
$signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';

if (!hash_equals($hash, $signature)) {
    throw new Exception('Invalid signature.');
}

[driesvints]

Thanks! I think I took the example as it was presented in the docs at the time. They've probably changed since.