lib/WebhookSignature.php
public static function verifyHeader($payload, $header, $secret, $tolerance = null)
    {
        // Extract timestamp and signatures from header
        $timestamp = self::getTimestamp($header);
        $signatures = self::getSignatures($header, self::EXPECTED_SCHEME);
        if ($timestamp == -1) {
            throw new Error\SignatureVerification(
                "Unable to extract timestamp and signatures from header",
                $header,
                $payload
            );
        }
        if (empty($signatures)) {
            throw new Error\SignatureVerification(
                "No signatures found with expected scheme",
                $header,
                $payload
            );
        }

        // Check if expected signature is found in list of signatures from
        // header
        $signedPayload = "$timestamp.$payload";
        $expectedSignature = self::computeSignature($signedPayload, $secret);
        $signatureFound = false;
        foreach ($signatures as $signature) {
            if (Util\Util::secureCompare($expectedSignature, $signature)) {
                $signatureFound = true;
                break;
            }
        }
        if (!$signatureFound) {
            throw new Error\SignatureVerification(
                "No signatures found matching the expected signature for payload",
                $header,
                $payload
            );
        }

        // Check if timestamp is within tolerance
        if (($tolerance > 0) && ((time() - $timestamp) > $tolerance)) {
            throw new Error\SignatureVerification(
                "Timestamp outside the tolerance zone",
                $header,
                $payload
            );
        }

        return true;
    }
public static function verifyHeader($payload, $header, $secret, $tolerance = null)
    {
        // Extract timestamp and signatures from header
        $timestamp = self::getTimestamp($header);
        $signatures = self::getSignatures($header, self::EXPECTED_SCHEME);
        if ($timestamp == -1) {
            throw new Error\SignatureVerification(
                "Unable to extract timestamp and signatures from header",
                $header,
                $payload
            );
        }
        if (empty($signatures)) {
            throw new Error\SignatureVerification(
                "No signatures found with expected scheme",
                $header,
                $payload
            );
        }

        // Check if expected signature is found in list of signatures from
        // header
        $signedPayload = "$timestamp.$payload";
        $expectedSignature = self::computeSignature($signedPayload, $secret);
        $signatureFound = false;
        foreach ($signatures as $signature) {
            if (Util\Util::secureCompare($expectedSignature, $signature)) {
                $signatureFound = true;
                break;
            }
        }
        if (!$signatureFound) {
            throw new Error\SignatureVerification(
                "No signatures found matching the expected signature for payload",
                $header,
                $payload
            );
        }

        // Check if timestamp is within tolerance
        if (($tolerance > 0) && ((time() - $timestamp) > $tolerance)) {
            throw new Error\SignatureVerification(
                "Timestamp outside the tolerance zone",
                $header,
                $payload
            );
        }

        return true;
    }
public static function verifyHeader ( $ payload , $ header , $ secret , $ tolerance = null ) { // Extract timestamp and signatures from header $ timestamp = self :: getTimestamp ( $ header ) ; $ signatures = self :: getSignatures ( $ header , self :: EXPECTED_SCHEME ) ; if ( $ timestamp == - 1 ) { throw new Error \ SignatureVerification ( "Unable to extract timestamp and signatures from header" , $ header , $ payload ) ; } if ( empty ( $ signatures ) ) { throw new Error \ SignatureVerification ( "No signatures found with expected scheme" , $ header , $ payload ) ; } // Check if expected signature is found in list of signatures from // header $ signedPayload = "$timestamp.$payload" ; $ expectedSignature = self :: computeSignature ( $ signedPayload , $ secret ) ; $ signatureFound = false ; foreach ( $ signatures as $ signature ) { if ( Util \ Util :: secureCompare ( $ expectedSignature , $ signature ) ) { $ signatureFound = true ; break ; } } if ( ! $ signatureFound ) { throw new Error \ SignatureVerification ( "No signatures found matching the expected signature for payload" , $ header , $ payload ) ; } // Check if timestamp is within tolerance if ( ( $ tolerance > 0 ) && ( ( time ( ) - $ timestamp ) > $ tolerance ) ) { throw new Error \ SignatureVerification ( "Timestamp outside the tolerance zone" , $ header , $ payload ) ; } return true ; }
Verifies the signature header sent by Stripe. Throws a
SignatureVerification exception if the verification fails for any
reason.

@param string $payload the payload sent by Stripe.
@param string $header the contents of the signature header sent by
Stripe.
@param string $secret secret used to generate the signature.
@param int $tolerance maximum difference allowed between the header's
timestamp and the current time
@throws \Stripe\Error\SignatureVerification if the verification fails.
@return bool
Verifies the signature header sent by Stripe . Throws a SignatureVerification exception if the verification fails for any reason .