اسأل، أو دعنا نخبرك، أو خذ كل شيء.

تحقق من أنه جاء منا

HMAC قياسي، بلا حاجة إلى مكتبة. ارفض الطوابع الزمنية القديمة، وقارن في زمن ثابت، فلا يعاد إرسال طلب ملتقط إليك.

// Every webhook carries: Saqr-Signature: t=<unix seconds>,v1=<hex>
// v1 is HMAC-SHA256 of "<t>.<raw body>" with your endpoint secret.
async function verify(raw: string, header: string, secret: string) {
  const { t, v1 } = Object.fromEntries(
    header.split(",").map((p) => p.split("=") as [string, string])
  );
  // Reject anything older than five minutes: a captured request replayed later.
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;

  const key = await crypto.subtle.importKey(
    "raw", new TextEncoder().encode(secret),
    { name: "HMAC", hash: "SHA-256" }, false, ["sign"]
  );
  const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${t}.${raw}`));
  const hex = [...new Uint8Array(mac)].map((b) => b.toString(16).padStart(2, "0")).join("");
  // Compare every character, so the time taken says nothing about where they differ.
  let diff = hex.length ^ v1.length;
  for (let i = 0; i < hex.length; i++) diff |= hex.charCodeAt(i) ^ (v1.charCodeAt(i) || 0);
  return diff === 0;
}

// Deliveries are at-least-once: store evt ids and ignore a second arrival.