outgoing-webhook.js

// Verify this actually came from our vendor
const signature = _.toString(req.headers['x-${BRAND}-signature']);
const timestamp = _.toString(req.headers['x-${BRAND}-timestamp']);
if(!signature || !timestamp || !_.parseInt(timestamp) || !moment.unix(_.parseInt(timestamp)).isBetween(moment().add(-5, 'm'), moment().add(1, 'm'))){
  res.status(httpStatusCodes.BAD_REQUEST).send();
  return;
}

// The initial required fields are there and they are within the time flex range, compute the expected hash
const hmac = crypto.createHmac('sha256', config.SIGNING_SECRET);
const [version, hash] = signature.split('=');

hmac.update(`${version}:${timestamp}:${JSON.stringify(req.body)}`);

// check the computed hash is what we expect
if(hmac.digest('hex') !== hash){
  res.status(httpStatusCodes.BAD_REQUEST).send();
  return;
}

// Ok, looks like the vendor actually sent the request, lets try to process their request