HMAC Verification with Node.js

hmac-verification.js

var qs = require('qs');
var crypto = require('crypto');

/**
 * @param {http request} req
 * @param {!string} apiKey
 * @return {Boolean} True if verified
 */
function verifyCallback(req, apiKey) {

    var url = req.headers['x-forwarded-proto'] + "://" + req.hostname + req.url;
    var method = req.method;
    var params = req.body;

    // Sort the params.
    var sorted_params = qs.stringify(params, { arrayFormat: 'brackets' }).split("&").sort(sortByPropertyOnly).join("&").replace(/%20/g, '+');

    var nonce = req.headers["x-authy-signature-nonce"];
    var data = nonce + "|" + method + "|" + url + "|" + sorted_params;

    var computed_sig = crypto.createHmac('sha256', apiKey).update(data).digest('base64');
    var sig = req.headers["x-authy-signature"];

    return sig == computed_sig;
}

/**
 * Sort by property only.
 *  Normal JS sort parses the entire string so a stringified array value like 'events=zzzz'
 *  would be moved after 'events=aaaa'.
 *
 *  Instead we split tokenize the string around the '=' value and only sort alphabetically
 *  by the property.
 *
 * @param {string} x
 * @param {string} y
 * @returns {number}
 */
function sortByPropertyOnly(x, y){
    var xx = x.split("=");
    var yy = y.split("=");

    if (xx < yy) {
        return -1;
    }
    if (xx > yy) {
        return 1;
    }
    return 0;
}