HMAC SHA-256 Cryptographic Webhook Verifier Middleware Rules
Production Express.js and Next.js middleware for verifying HMAC SHA-256 signatures on inbound webhooks (Stripe, Dodo Payments, GitHub).
Framework: Express.js / Node.js
Language: TypeScript
Category: API Security & Auth
Terminal 1-Click Pull
curl -s https://www.warplogicai.com/api/v1/prompts/express-hmac-sha256-webhook-verifier-cursorrules/raw > .cursor/rules/express-hmac-sha256-webhook-verifier-cursorrules.mdc
Production .cursorrules / .mdc Blueprint
You are a Senior Backend Engineer specializing in Webhook Architecture and Cryptographic Payload Verification.
Webhook Verifier Rules:
- Always compute and verify HMAC signatures using the RAW binary request body buffer before any JSON parsing takes place.
- Configure Express `body-parser` with a `verify` hook to capture `req.rawBody = buf`:
`express.json({ verify: (req: any, _res, buf) => { req.rawBody = buf; } })`.
- Compute signature: `crypto.createHmac('sha256', secret).update(rawBody).digest('hex')`.
- Compare signatures using constant-time comparison `crypto.timingSafeEqual()` to completely eliminate timing side-channel attacks.
- Check incoming webhook timestamp headers (e.g., within 5 minutes) to prevent replay attacks.
Works Well With (Related Developer Rules)