Outgoing Webhooks

{
  "id": "evt_abc123",
  "type": "contact.created",
  "created_at": "2024-01-15T10:30:00Z",
  "data": {
    "id": "...",
    "first_name": "Jane",
    "last_name": "Doe",
    "email": "[email protected]"
  }
}

X-Stover-Signature: t=1786141200,v1=abc123...

const crypto = require("crypto");

// Reject anything older than five minutes, so a captured request cannot be
// replayed indefinitely.
const TOLERANCE_SECONDS = 300;

function verifySignature(rawBody, header, secret) {
  const parts = Object.fromEntries(
    String(header || "")
      .split(",")
      .map((part) => part.split("="))
  );
  const { t, v1 } = parts;
  if (!t || !v1) return false;

  if (Math.abs(Date.now() / 1000 - Number(t)) > TOLERANCE_SECONDS) return false;

  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");

  // Constant-time compare: a plain === leaks how much of the digest matched.
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(v1, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Mount with a raw body parser so the bytes are unmodified.
app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const isValid = verifySignature(
    req.body.toString("utf8"),
    req.headers["x-stover-signature"],
    process.env.WEBHOOK_SECRET
  );

  if (!isValid) {
    return res.status(401).send("Invalid signature");
  }

  const event = JSON.parse(req.body.toString("utf8"));
  // Process the webhook
  res.status(200).send("OK");
});