Fix Insecure Webhooks in Koa

const Koa = require('koa');
const bodyParser = require('koa-bodyparser');
const app = new Koa();
app.use(bodyParser());
app.use(async (ctx) => {
if (ctx.path === ‘/webhook’ && ctx.method === ‘POST’) {
// VULNERABILITY: No signature verification.
// Anyone can send a POST request to this endpoint with a fake payload.
const { event, userId } = ctx.request.body;
console.log(Processing ${event} for user ${userId});
ctx.status = 200;
}
});
app.listen(3000);

const Koa = require('koa');
const bodyParser = require('koa-bodyparser');
const crypto = require('crypto');
const app = new Koa();
const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET;
app.use(bodyParser());
app.use(async (ctx, next) => {
if (ctx.path === ‘/webhook’ && ctx.method === ‘POST’) {
const signature = ctx.get(‘X-Hub-Signature-256’);
if (!signature) {
ctx.status = 401;
return;
}
// Use the raw body for signature verification to avoid issues with parser mutations
const hmac = crypto.createHmac('sha256', WEBHOOK_SECRET);
const digest = Buffer.from('sha256=' + hmac.update(JSON.stringify(ctx.request.body)).digest('hex'), 'utf8');
const checksum = Buffer.from(signature, 'utf8');

// crypto.timingSafeEqual prevents timing attacks
if (checksum.length !== digest.length || !crypto.timingSafeEqual(digest, checksum)) {
  ctx.status = 403;
  ctx.body = 'Invalid signature';
  return;
}

console.log('Verified Webhook Received');
ctx.status = 200;
}
await next();
});
app.listen(3000);