Webhook HMAC Signature Verification (Node.js Generator)

const express = require("express");
const crypto = require("crypto");

const app = express();
const SECRET = process.env.WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

if (!SECRET) {
  throw new Error("WEBHOOK_SECRET is not set");
}

// Raw body is required: the HMAC is computed over the exact bytes sent
app.post("/webhooks/erp", express.raw({ type: "*/*", limit: "1mb" }), (req, res) => {
  const signature = req.get("x-signature") || "";
  const timestamp = req.get("x-timestamp") || "";

  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
  if (!timestamp || Number.isNaN(age) || age > TOLERANCE_SECONDS) {
    return res.status(400).send("stale or missing timestamp");
  }

  // Signed content here is timestamp + "." + body; match your sender's format
  const signedContent = Buffer.concat([Buffer.from(timestamp + "."), req.body]);
  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(signedContent)
    .digest("hex");

  const given = Buffer.from(signature, "utf8");
  const wanted = Buffer.from(expected, "utf8");
  if (given.length !== wanted.length || !crypto.timingSafeEqual(given, wanted)) {
    return res.status(401).send("invalid signature");
  }

  let event;
  try {
    event = JSON.parse(req.body.toString("utf8"));
  } catch (err) {
    return res.status(400).send("invalid json");
  }

  // Acknowledge fast, then process asynchronously (queue, worker, agent)
  res.status(200).send("ok");
  setImmediate(() => console.log("received event", event.type || "unknown"));
});

app.listen(3000, () => console.log("listening on 3000"));