Quickstart

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = process.env.ZAHER_WEBHOOK_SECRET!; // whsec_…
const app = express();

// Keep the raw body: the signature is computed over the exact bytes sent.
app.post(
  "/webhooks/zaher",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const body = req.body.toString("utf8");
    if (!isValid(body, req.header("X-Zaher-Signature"), req.header("X-Zaher-Timestamp"))) {
      return res.sendStatus(400);
    }

    const event = JSON.parse(body);
    console.log("Received", event.type, event.id);

    res.sendStatus(200); // acknowledge fast; do slow work afterwards
  }
);

function isValid(body: string, signatureHeader?: string, timestamp?: string) {
  if (!signatureHeader || !timestamp) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const expected = createHmac("sha256", SECRET)
    .update(`${timestamp}.${body}`)
    .digest();

  return signatureHeader.split(",").some((part) => {
    const [version, hex] = part.trim().split("=");
    const received = Buffer.from(hex ?? "", "hex");
    return (
      version === "v1" &&
      received.length === expected.length &&
      timingSafeEqual(received, expected)
    );
  });
}

app.listen(3000);