Loading…
Check the signature (Node.js)
// Header: NH-Signature: t=<unix seconds>,kid=<key id>,v1=<hex>
import { createHmac, timingSafeEqual } from 'node:crypto';
export function verify(header, rawBody, secretsByKeyId) {
const p = Object.fromEntries(header.split(',').map(x => x.split('=')));
const secret = secretsByKeyId[p.kid];
if (!secret || Math.abs(Date.now() / 1000 - Number(p.t)) > 300) return false;
const want = createHmac('sha256', secret).update(`${p.t}.${rawBody}`).digest();
return want.length === 32 && timingSafeEqual(want, Buffer.from(p.v1 ?? '', 'hex'));
}
// Answer 2xx quickly; we retry anything else for 24 hours. Drop repeats by the NH-Event-Id header.