Webhook Verification

// Express 5 - raw body for Stripe
import express from "express";
import Stripe from "stripe";
 
const app = express();
app.post(
  "/webhooks/stripe",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const sig = req.headers["stripe-signature"] as string;
    try {
      const event = Stripe.webhooks.constructEvent(
        req.body,
        sig,
        process.env.STRIPE_WEBHOOK_SECRET!
      );
      // dispatch event.type
      res.json({ received: true });
    } catch {
      res.status(400).send("invalid signature");
    }
  }
);

// src/webhooks/stripe.ts
import type { Request, Response } from "express";
import Stripe from "stripe";
import { getStripe } from "../integrations/stripe-client";
import { paymentsQueue } from "../queues/payments";
 
const stripe = getStripe();
 
export async function stripeWebhookHandler(req: Request, res: Response) {
  const sig = req.headers["stripe-signature"];
  if (!sig || !Buffer.isBuffer(req.body)) {
    return res.status(400).send("bad request");
  }
 
  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(
      req.body,
      sig,
      process.env.STRIPE_WEBHOOK_SECRET!
    );
  } catch (err) {
    console.warn({ msg: "stripe_sig_fail", err: (err as Error).message });
    return res.status(400).send("invalid signature");
  }
 
  if (await isEventProcessed(event.id)) {
    return res.json({ received: true, duplicate: true });
  }
 
  await markEventReceived(event.id);
 
  if (event.type === "payment_intent.succeeded") {
    await paymentsQueue.add("fulfill", { paymentIntentId: (event.data.object as Stripe.PaymentIntent).id });
  }
 
  res.json({ received: true });
}
 
// Generic HMAC verification (Twilio-style)
import { createHmac, timingSafeEqual } from "node:crypto";
 
export function verifyHmacSha256(rawBody: Buffer, signature: string, secret: string): boolean {
  const expected = createHmac("sha256", secret).update(rawBody).digest("base64");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

// Mount webhook routes BEFORE express.json() globally
const webhookRouter = express.Router();
webhookRouter.post("/stripe", express.raw({ type: "application/json" }), stripeWebhookHandler);
app.use("/webhooks", webhookRouter);
app.use(express.json());

// Reject events older than 5 minutes (custom parsers)
const ts = Number(req.header("X-Webhook-Timestamp"));
if (Math.abs(Date.now() / 1000 - ts) > 300) {
  return res.status(400).send("stale");
}

import twilio from "twilio";
const valid = twilio.validateRequest(
  process.env.TWILIO_AUTH_TOKEN!,
  req.headers["x-twilio-signature"] as string,
  fullUrl,
  req.body
);