validation of x-hub-signature header facebook

index.js

const crypto = require('crypto');
const jsesc = require('jsesc');

//inside express route handler
const xHubSignature = req.headers['x-hub-signature'];
if (this.validateSignature(xHubSignature, req.body)) {
  console.log('valid signature');
}
 
/**
 * given xHubSignature and body request as JSON, return boolean if signed response matches expected signature
 */
validateSignature(xHubSignature, body) {

    let isValid = false;
    body = jsesc(body, {
        json: true,
        escapeEverything: false,
        lowercaseHex: true
    });
    if (process.env.FACEBOOK_APP_SECRET) {
        const signature = 'sha1=' + crypto.createHmac('sha1', process.env.FACEBOOK_APP_SECRET).update(body).digest('hex');
        isValid = (xHubSignature === signature);
    } else {
        console.log('missing FACEBOOK_APP_SECRET env variable');
    }
    return isValid;
}