Signature Verification

Every webhook payload dispatched by AuthSetu includes an `AuthSetu-Signature` header computed using HMAC-SHA256 and your endpoint's shared webhook secret.

Signature Header Format

The header contains a timestamp `t` and a hex signature `v1`:

AuthSetu-Signature: t=1728800000,v1=9c4a8f...

Node.js / TypeScript Verification

import crypto from 'node:crypto';

export function verifyWebhookSignature(
  rawBody: string,
  signatureHeader: string,
  secret: string
): boolean {
  const parts = signatureHeader.split(',');
  const t = parts.find((p) => p.startsWith('t='))?.slice(2);
  const v1 = parts.find((p) => p.startsWith('v1='))?.slice(3);

  if (!t || !v1) return false;

  // Protect against replay attacks (reject payloads older than 5 minutes)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(t)) > 300) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${rawBody}`)
    .digest('hex');

  return crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}