Build a Secure Webhook Receiver with Signature Verification

const express = require('express');
const crypto = require('crypto');
const bodyParser = require('body-parser');

const app = express();
const WEBHOOK_SECRET = 'your_super_secret_key_here'; // Use a strong, unique secret

// Use rawBody for signature verification as express.json() parses it too early
app.use(bodyParser.json({
  verify: (req, res, buf) => {
    if (req.originalUrl === '/webhook-endpoint') { // Only apply to webhook endpoint
      req.rawBody = buf;
    }
  }
}));

app.post('/webhook-endpoint', (req, res) => {
  if (!req.rawBody) {
    return res.status(400).send('Webhook payload missing.');
  }

  const signature = req.headers['x-hub-signature-256'] || req.headers['x-signature']; // Common headers

  if (!signature) {
    return res.status(401).send('No signature provided.');
  }

  const hmac = crypto.createHmac('sha256', WEBHOOK_SECRET);
  hmac.update(req.rawBody);
  const digest = `sha256=${hmac.digest('hex')}`; // Some providers prefix, e.g., 'sha256='

  if (digest !== signature) {
    console.warn('Webhook signature verification failed.');
    return res.status(403).send('Invalid signature.');
  }

  // If signature is valid, process the webhook payload
  console.log('Webhook payload received and verified:', req.body);
  // Example: Trigger further processing based on req.body.event_type

  res.status(200).send('Webhook received successfully.');
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Webhook receiver listening on port ${PORT}`);
});