An extremely simple Flask app that accepts Optimizely webhook requests and verifies their signatures

optimizely_secure_webhooks.py

# Example Flask implementation of secure webhooks
# Assumes webhook's secret is stored in the environment variable WEBHOOK_SECRET

from hashlib import sha1
import hmac
import os

from flask import Flask, request, abort

@app.route('/webhooks/optimizely', methods=['POST'])
def index():
  request_signature = request.headers.get('X-Hub-Signature')
  computed_signature = 'sha1' + hmac.new(os.environ['WEBHOOK_SECRET'],msg=request.data, digestmod=sha1)

  if not hmac.compare_digest(computed_signature.hexdigest(), request_signature):
    abort(500)

Hi,

computed_signature = 'sha1' + hmac.new(os.environ['WEBHOOK_SECRET'],msg=request.data, digestmod=sha1)

shouldn't the prefix be 'sha1=' as reported by https://developers.optimizely.com/x/solutions/sdks/reference/index.html?language=python#webhooks ?