williamdias

def request_is_authentic?
  body = request.body.read
  hmac = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha1'), ENV.fetch("NFEIO_WEBHOOK_SECRET"), body)
  hash = 'sha1=' + Base64.strict_encode64(hmac)
  signature = request.headers['X-NFEIO-Signature']
  ActiveSupport::SecurityUtils.secure_compare(hash, signature)
end