LackedOriginal post
Rank 2: Process
Here's a code snippet
Plain text
const signature = req.headers['x-appwrite-webhook-signature']; if (!signature) { return res.json({ error: "Bad signature request" }); } // Create expected signature const expectedSignature = crypto.createHmac('sha1', process.env.WEBHOOK_SIG_KEY) .update(`${process.env.WEBHOOK_ENDPOINT}${JSON.stringify(payload)}`) .digest('base64');
// Securely compare the signatures if (!crypto.timingSafeEqual(Buffer.from(expectedSignature, 'base64'), Buffer.from(signature, 'base64'))) { return res.json({ error: "Unauthorized" }); }...```
Is this enough to keep my webhook secure?Summary
Code snippet provided shows how a developer is verifying the authenticity of a webhook message in Node.js by comparing signatures. It includes comparing expected and actual signatures using `crypto.timingSafeEqual`. This approach is secure, given proper implementation of `WEBHOOK_SIG_KEY`.