Verifying signatures

// verify-webhook.mjs
import { createHmac, timingSafeEqual } from "node:crypto";

/**
 * @param {string} secret   The endpoint's signing secret (whsec_...).
 * @param {Record<string, string | undefined>} headers  Request headers, lower-cased names.
 * @param {string} rawBody  The request body exactly as received.
 * @returns {boolean} true only if the request is authentic and recent.
 */
export function verifyWebhook(secret, headers, rawBody, toleranceSeconds = 300) {
  const timestamp = headers["webhook-timestamp"] ?? "";
  if (!/^\d{1,12}$/.test(timestamp)) return false;
  // Reject old requests so a captured one cannot be replayed later.
  if (Math.abs(Date.now() / 1000 - parseInt(timestamp, 10)) > toleranceSeconds) return false;

  const expected = createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest();
  // During a secret rotation the header carries two signatures: accept either.
  return (headers["webhook-signature"] ?? "")
    .split(",")
    .map((part) => part.trim())
    .filter((part) => part.startsWith("v1="))
    .some((part) => {
      const given = Buffer.from(part.slice(3), "hex");
      return given.length === expected.length && timingSafeEqual(given, expected);
    });
}

import express from "express";
import { verifyWebhook } from "./verify-webhook.mjs";

const app = express();

app.post("/webhooks/stellar", express.text({ type: "application/json" }), (req, res) => {
  if (!verifyWebhook(process.env.WEBHOOK_SECRET, req.headers, req.body)) {
    return res.status(400).send("invalid signature");
  }
  const event = JSON.parse(req.body);
  // 1. Skip it if event.id was already processed.  2. Store it.  3. Answer, then do the work.
  res.sendStatus(200);
});

app.listen(3000);