webhook_authentication_signature_example.js

const crypto = require('crypto');

const hmac = crypto.createHmac('SHA256', 'my-webhook-secret');
hmac.update('{ ... }'); // request body
const correctHash = hmac.digest().toString('hex');

const receivedHash = '...'; // e.g. req.get('x-impala-signature');

/*
 * It's important to perform a constant time equality comparison of the
 * two HMACs to avoid timing attacks.
 *
 * See: https://en.wikipedia.org/wiki/Timing_attack
 */
if (
  crypto.timingSafeEqual(
    Buffer.from(correctHash),
    Buffer.from(receivedHash)
  )
) {
  // Request is valid
} else {
  throw new Error('Authentication failed.');
}

Hey all, just a quick note that node's default encoding for the Buffer.from function is UTF-8.
https://nodejs.org/api/buffer.html#buffer_static_method_buffer_from_string_encoding

We had a couple of issues with mismatching signatures due to this.

@PeterKottas your implementation, much like mine, might have the same issue.