validateComputedSignature (Webhooks)

Validates a Stripe webhook signature by comparing computed and expected signatures, checking payload type, and enforcing timestamp tolerance.

  function validateComputedSignature(
    payload: string,
    header: string,
    details: WebhookParsedHeader,
    expectedSignature: string,
    tolerance: number,
    suspectPayloadType: boolean,
    secretContainsWhitespace: boolean,
    receivedAt?: number
  ): boolean {
    const signatureFound = !!details.signatures.filter(
      platformFunctions.secureCompare.bind(platformFunctions, expectedSignature)
    ).length;

    const docsLocation =
      '\nLearn more about webhook signing and explore webhook integration examples for various frameworks at ' +
      'https://docs.stripe.com/webhooks/signature';

    const whitespaceMessage = secretContainsWhitespace
      ? '\n\nNote: The provided signing secret contains whitespace. This often indicates an extra newline or space is in the

... (truncated -- full source via MCP)