Verifying Webhook Signatures

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const secret = process.env.OP26X_WEBHOOK_SECRET;

app.post('/webhooks/op26x', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.get('x-op26x-signature');
  const timestamp = req.get('x-op26x-timestamp');
  const deliveryId = req.get('x-op26x-delivery');

  if (!signature || !timestamp || !deliveryId || !secret) {
    return res.sendStatus(400);
  }

  const ageSeconds = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(ageSeconds) || ageSeconds > 300) {
    return res.sendStatus(401);
  }

  const expected = crypto
    .createHmac('sha256', secret)
    .update(req.body)
    .digest('hex');

  const expectedBuffer = Buffer.from(expected, 'utf8');
  const receivedBuffer = Buffer.from(signature, 'utf8');

  if (
    expectedBuffer.length !== receivedBuffer.length ||
    !crypto.timingSafeEqual(expectedBuffer, receivedBuffer)
  ) {
    return res.sendStatus(401);
  }

  const event = JSON.parse(req.body.toString('utf8'));
  enqueueForProcessing(deliveryId, event);
  return res.sendStatus(202);
});