The Fundamentals of API Development and Third-Party System Integrations for Business

import crypto from 'crypto';
import { Request, Response } from 'express';

// Securely verify incoming third-party Webhook payloads using HMAC signatures
export function verifyWebhookSignature(req: Request, res: Response, next: Function) {
  const signature = req.headers['x-xiyor-signature'] as string;
  const secret = process.env.WEBHOOK_SECRET_KEY!;

  if (!signature) {
    return res.status(401).json({ error: 'Missing security signature header' });
  }

  // Compute expected HMAC SHA-256 hash over raw request body
  const expectedHash = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(req.body))
    .digest('hex');

  // Perform constant-time timing-safe comparison to prevent timing attacks
  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedHash)
  );

  if (!isValid) {
    return res.status(403).json({ error: 'Invalid HMAC signature. Reject payload.' });
  }

  next();
}