Daan Schouteden
31 lines
719 B
TypeScript
31 lines
719 B
TypeScript
import crypto from "node:crypto";
|
|
|
|
export function verifySignature(input: {
|
|
secret: string;
|
|
body: string;
|
|
signatureHeader?: string | null;
|
|
}): boolean {
|
|
const { secret, body, signatureHeader } = input;
|
|
if (!signatureHeader) {
|
|
return false;
|
|
}
|
|
|
|
const expected = crypto
|
|
.createHmac("sha256", secret)
|
|
.update(body, "utf8")
|
|
.digest("hex");
|
|
|
|
const provided = signatureHeader.startsWith("sha256=")
|
|
? signatureHeader.slice("sha256=".length)
|
|
: signatureHeader;
|
|
|
|
const expectedBuf = Buffer.from(expected);
|
|
const providedBuf = Buffer.from(provided);
|
|
|
|
if (expectedBuf.length !== providedBuf.length) {
|
|
return false;
|
|
}
|
|
|
|
return crypto.timingSafeEqual(expectedBuf, providedBuf);
|
|
}
|