secure-webhooks

Useful for securing webhooks.

Usage

On the webhook sender:

import{symmetric}from"secure-webhooks"constsecret="some shared secret"constpayload="...";constsignature=symmetric.sign(payload,secret);sendToWebhookReceiver({body: payload,headers: {"x-webhook-signature": signature
...
}})

On the webhook receiver:

import{symmetric}from"secure-webhooks"constsecret="some shared secret"// the same as aboveapp.post("/webhook-endpoint",(req,res)=>{constisTrustWorthy=symmetric.verify(req.body,// 👈 needs to be exactly the same as above, make sure to disable any body parsing for this routesecret,req.headers["x-webhook-signature"])if(!isTrustWorthy){res.status(401).end("Not Authorized")return}
...
})

Same works with asymmetric mode:

import{asymmetric}from"secure-webhooks"