Validate webhook authenticity using HMAC signatures.
Updated
Always verify webhook signatures to ensure the request genuinely came from DashForDevs and hasn't been tampered with. Without verification, anyone could send fake events to your endpoint.
Every webhook request includes an x-dash4devs-signature header containing an HMAC-SHA256 hash of the request body, signed with your webhook secret.
import crypto from "crypto"
function verifyWebhookSignature(
body: string,
signature: string,
secret: string
): boolean {
const expected = crypto
.createHmac("sha256", secret)
.update(body)
.digest("hex")
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
)
}
timingSafeEqual instead of === to prevent timing attacks.
// app/api/webhooks/dash4devs/route.ts
import { NextRequest, NextResponse } from "next/server"
import crypto from "crypto"
const SECRET = process.env.DASH4DEVS_WEBHOOK_SECRET!
export async function POST(req: NextRequest) {
const body = await req.text()
const signature = req.headers.get("x-dash4devs-signature") || ""
const expected = crypto
.createHmac("sha256", SECRET)
.update(body)
.digest("hex")
const valid = crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
)
if (!valid) {
return NextResponse.json({ error: "Invalid signature" }, { status: 401 })
}
const event = JSON.parse(body)
// Process the verified event...
return NextResponse.json({ received: true })
}
import hmac
import hashlib
def verify_signature(body: bytes, signature: str, secret: str) -> bool:
expected = hmac.new(
secret.encode(),
body,
hashlib.sha256
).hexdigest()
return hmac.compare_digest(signature, expected)
# .env
DASH4DEVS_WEBHOOK_SECRET=whsec_your_signing_secret_here