How can I verify a webhook signature header using SHA‑512 in Node.js?

Below is an approach for verifying the signature on your webhook call. Since the crypto module is built into Node.js, you don't need to install an extra package. The idea is to use your shared secret to generate an HMAC using SHA‑512 on the raw payload and then compare that to the signature provided in the header (x-nowpayments-sig).

Important Considerations

• Raw Payload: Ensure you're using the raw body of the HTTP request when generating the HMAC. If you parse the JSON, the formatting might change and the signature verification will fail.
• Timing: Comparing the computed signature to the header should be done in a safe manner. (For example, you may use a constant-time comparison method to avoid timing attacks in a production environment.)

Sample Code with Express

Below is an example of how you could implement this in an Express application:

JAVASCRIPTCopied
const express = require('express');
const crypto = require('crypto');
const app = express();

// Use express.json with a verify callback to capture the raw body
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf.toString();
  }
}));

function verifySignature(payload, signature, secret) {
  const hash = crypto.createHmac('sha512', secret)
                     .update(payload)
                     .digest('hex');
  return hash === signature;
}

app.post('/webhook', (req, res) => {
  // Extract signature from header
  const signature = req.headers['x-nowpayments-sig'];
  if (!signature) {
    return res.status(400).send('Signature missing');
  }

  // Replace 'YOUR_SECRET_KEY' with your actual shared secret used for HMAC generation
  const secret = 'YOUR_SECRET_KEY';
  const payload = req.rawBody;

  if (!verifySignature(payload, signature, secret)) {
    return res.status(401).send('Invalid signature');
  }

  // If the signature is verified, process your webhook payload
  console.log('Webhook payload verified:', req.body);
  res.status(200).send('Webhook received successfully');
});

app.listen(3000, () => {
  console.log('Server listening on port 3000');
});

Explanation

1. Capturing the Raw Payload:
   We set up the Express middleware to capture the raw request body in req.rawBody (this is critical for HMAC computation).

2. Signature Verification Function:
   The verifySignature function takes the raw payload, the received signature, and your secret. It computes an HMAC using SHA‑512 and returns true if the computed hash matches the signature.

3. Webhook Route:
   In the /webhook handler, the signature is extracted from the headers and verified against the raw request body. If verification fails, the request is rejected with a 401 status code.

This method allows you to safely verify that incoming webhook calls originate from nowpayments using the shared secret and SHA‑512 HMAC.