[sebxt]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Problem/Feature

When a custom --timestamp is valid RFC3339Nano but not in Go's canonical output form (for example 2023-01-01T00:00:00.000Z or 2023-01-01T00:00:00+00:00), the webhook signature is computed over a reformatted timestamp while the Twitch-Eventsub-Message-Timestamp header carries the original string. Receivers that verify signatures as documented by Twitch reject these events.

Description of Changes:

• getSignatureHeader now writes the message id and the timestamp string exactly as sent in the header into the HMAC, instead of parsing and reformatting it.
• Added TestForwardEventSignatureUsesTimestampHeader, which forwards events with three non canonical timestamps to a test server and verifies the signature from the received headers and body.

Checklist

• My code follows the Contribution Guide
• I have self-reviewed the changes being requested
• I have made comments on pieces of code that may be difficult to understand for other editors
• I have updated the documentation (if applicable)

Fixes #363