Verify Webhook Signatures

const express = require('express');
const crypto = require('crypto');

const app = express();

// The raw body is required to compute the signature correctly.
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signatureHeader = req.headers['blink-signature'];
  const timestamp = req.headers['blink-timestamp'];
  const webhookSecret = 'whsec_your_signing_secret_here';

  if (!signatureHeader || !timestamp) {
    return res.status(400).send('Missing webhook headers');
  }

  // Extract the actual signature hash from the v1= prefix
  const signature = signatureHeader.replace('v1=', '');

  // 1. Prepare the payload string
  const payloadToSign = `${timestamp}.${req.body.toString('utf8')}`;

  // 2. Compute the HMAC SHA-256 signature
  const expectedSignature = crypto
    .createHmac('sha256', webhookSecret)
    .update(payloadToSign)
    .digest('hex');

  // 3. Compare the signatures securely
  if (crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))) {
    console.log('✅ Webhook signature verified!');
    
    // Parse the body and process the event
    const event = JSON.parse(req.body.toString('utf8'));
    console.log(`Received event: ${event.event}`);
    
    res.status(200).send('OK');
  } else {
    console.error('❌ Invalid webhook signature');
    res.status(401).send('Invalid signature');
  }
});

app.listen(3000, () => console.log('Listening on port 3000'));

import { NextResponse } from 'next/server';
import crypto from 'crypto';

export async function POST(req: Request) {
  const signatureHeader = req.headers.get('blink-signature');
  const timestamp = req.headers.get('blink-timestamp');
  const webhookSecret = process.env.BLINK_WEBHOOK_SECRET!;

  if (!signatureHeader || !timestamp) {
    return NextResponse.json({ error: 'Missing headers' }, { status: 400 });
  }

  const signature = signatureHeader.replace('v1=', '');
  const rawBody = await req.text();
  const payloadToSign = `${timestamp}.${rawBody}`;

  const expectedSignature = crypto
    .createHmac('sha256', webhookSecret)
    .update(payloadToSign)
    .digest('hex');

  if (signature !== expectedSignature) {
    return NextResponse.json({ error: 'Invalid signature' }, { status: 401 });
  }

  const event = JSON.parse(rawBody);
  console.log('✅ Verified Event:', event.event);

  return NextResponse.json({ received: true });
}